From today, organisations subject to PIPEDA have to keep a record of each breach of security safeguards, and report and notify people about any that pose a real risk of significant harm. This is a general summary, not legal advice.

What starts today

The breach rules in PIPEDA, the federal private-sector privacy law, are in force from today. They were added to the Act in 2015 and waited for regulations, which arrived in April.

An organisation covered by the law must now report serious breaches to the Privacy Commissioner of Canada and tell the people they affect. Every breach, serious or not, also goes in a record.

The Commissioner's office published its final guidance on Monday and offers a form for reports.

What follows is general information about how this touches a small business website, not legal advice.

Whether it applies to you

Whether PIPEDA covers a business comes down to where and how that business handles personal information, not simply where its office is.

Some provinces have their own private-sector privacy laws, which apply instead to much of the activity inside them.

Even there, PIPEDA generally reaches federally regulated businesses and personal information crossing provincial or national borders in commercial activity, so one business can answer to both laws.

Where the line falls for your business is worth an hour with a lawyer. A record and careful thought about risk are good habits under any of these laws.

Breaches a small business website can have

In the law's terms, a breach is the loss of personal information, or access to it or disclosure of it without authority, because a safeguard failed or never existed.

The second is the one nobody thinks of. A copy made for a redesign often holds the whole database, and can sit at a forgotten address for years without updates.

Not knowing is the usual case

Many website incidents end with an uncomfortable answer: something was exposed, and nobody can say whether anyone looked.

Server logs can sometimes settle it, but many hosting plans keep them only briefly.

Uncertainty is not a reason to stop. The risk depends partly on who may have had the information, any sign of intent to misuse it, and whether it was recovered.

Ask your host now how long logs are kept. The middle of an incident is a bad time to find out they cover only a few days.

The record every covered business keeps

Every breach goes in the record, including those that never need reporting. That is the part most likely to reach a small business, because small breaches are common.

Each entry is kept for 24 months from the day you decide a breach occurred, and the Commissioner can ask to see the record.

It must hold enough to show you met the reporting and notification rules. The guidance suggests at least the date, what happened, the information involved, and whether you reported and notified.

Where you decided not to report, write down why, at the time. A paragraph of reasoning beats a careful memory later.

When a breach must be reported

Reporting and notifying turn on one test, which the law calls a real risk of significant harm: whether the breach could reasonably lead to serious harm for someone.

Significant harm is broad. Humiliation and a damaged reputation count, as do financial loss and identity theft.

Two things decide it: how sensitive the information is, and the chance it has been or will be misused. Health and financial details rank high on the first; a known recipient who deleted a misdirected email, low on the second.

Once you decide a breach has happened and meets that test, the report and notices go out as soon as feasible. A first report can be incomplete and updated later.

The first hours of an incident

Contain it first: take the form or the copy offline, change the passwords involved, and update whatever had the flaw.

Keep the evidence while you do: ask the host to preserve the logs, and do not wipe and rebuild the site until somebody has looked.

Then write down what you know, when you learned it and who was told. Decide about reporting after that, with advice if the case is close.

A worked example

An HR consulting firm with five consultants runs hiring for small employers, posting their jobs on its website with an application form under each.

The form plugin stored every application in the site's database: names, contact details, resumes with home addresses, and expected salaries.

In September the web company found the plugin had a flaw that let outsiders read stored entries. The fix had been out for weeks, but updates were paused for a redesign.

The logs showed requests matching the flaw from an unknown address, and nobody could show whether entries had actually been read.

Under today's rules, that would go in the record, and the signs of deliberate access would weigh heavily towards reporting it.

The site now keeps nothing: each application passes straight to the firm's recruiting system and is deleted from the website. Updates no longer pause for redesigns.

Your web company and your host

The obligation sits with the organisation in control of the information, even when a supplier holds it or caused the problem.

Your web company, your host and any form or booking service should agree in writing to tell you promptly about anything that might have touched personal information.

None of this moves the duty to them. It gets you the facts in time to meet it.

The counter-case

Most incidents on a small business site will be minor: assessed, recorded in a few lines, and never reported. That is the system working.

A site that collects only newsletter addresses has less to record, and activity under a provincial law follows that law's rules instead.

Neither changes the habit worth starting today: record every breach, think the risk through in writing, and make sure your suppliers will tell you quickly.

From today

  1. Start the breach record today.
  2. Name the person who keeps it.
  3. Ask your host how long logs are kept.
  4. Find and remove old test copies of the site.
  5. Get suppliers to agree to tell you promptly.
  6. Delete stored entries nobody needs any more.
  7. Ask a lawyer which law covers what you do.

Step four removes a breach waiting to happen. A forgotten test copy holds the same customer data as the live site, gets none of its updates, and nobody is watching it.

What a third-party service keeps on your behalf is covered in what your online booking system knows about customers.

Frequently asked questions

What changes for businesses on November 1?

Any organisation subject to PIPEDA has to record each breach of security safeguards, report serious ones to the Privacy Commissioner, and notify the people they affect.

Does PIPEDA cover every Canadian business?

No. It depends on where and how a business handles personal information, and some provinces have their own private-sector privacy laws. A lawyer can say which applies.

Which website problems count as a breach?

Personal information lost, accessed or disclosed without authority because a safeguard failed, such as a flawed form plugin, a forgotten test copy or an old login still working.

What must the breach record contain?

Enough to show you met the rules: the date, what happened, the information involved, and whether you reported and notified, with your reasons if you did not.

How long must breach records be kept?

For 24 months from the day you determine the breach occurred. The Commissioner can ask to see the record, including breaches you decided not to report.

What if we cannot tell whether data was seen?

That is common. Record it, preserve the logs, and judge the risk from what you know: how sensitive the information was, who may have had it, and signs of misuse.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Not sure what your website stores?

We will list every form, copy and login on your site that holds personal information, and what can go.

Start a Conversation