Real risk of significant harm: the first 48 hours after a privacy breach

The Act does not set a 48-hour deadline. It says an institution must report to the Information and Privacy Commissioner of Ontario (IPC), and notify the people affected, “as soon as feasible” after the head determines that the breach occurred (MFIPPA s. 30.1(2) and (4) on e-Laws). Most of the decisions that matter are made in the first two days. This plan follows the order of the IPC’s Privacy Breaches: Guidelines for Public Sector Organizations (August 2026). The time blocks are our suggestion, not the law.

What counts as a breach

The Act’s test is “a theft, loss or unauthorized use or disclosure of personal information” in the institution’s custody or control (s. 30.1(1)). Everyday examples: a spreadsheet of names emailed to the wrong address, a lost laptop, a staff member looking up a neighbour’s file with no work reason, or ransomware on a system holding resident records.

Hours 0 to 4: assess and contain

The IPC’s first step is to assess and contain the scope of the breach. Find out what information is involved, how many people may be affected and which systems were touched. Then stop it spreading. Ask an unintended recipient to return or securely destroy the information and to confirm in writing that no copies were kept. Change passwords, or suspend a staff member’s access while you look into it.

Write down what you know and when you learned it. The Act measures “as soon as feasible” from when the head determines the breach occurred, so a clear note of that moment helps later.

Hours 4 to 24: decide whether there is a real risk of significant harm

Reporting and notice are required when it is reasonable in the circumstances to believe there is a real risk of significant harm to someone (s. 30.1(1) and (3)). The Act defines significant harm to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property (s. 30.1(10)).

The Act lists the factors to weigh (s. 30.1(7)):

• Sensitivity. Health details, financial information and government identifiers usually are sensitive. So can a name and address be, if the person is at risk from someone.
• Probability of misuse. A malicious actor, such as ransomware, phishing or snooping, raises the risk. An email sent to a known colleague who deleted it and confirmed so lowers it.
• Steps people can take. If the people affected could protect themselves, for example by changing passwords or watching their bank accounts, that weighs in favour of telling them.
• IPC guidance, and any further factor set by regulation.

The IPC notes that not every factor has to point the same way before notice is required. Write the decision down with your reasons, and have the head or the head’s delegate sign it.

Hours 24 to 48: notify and report

If the threshold is met, report the breach to the IPC using its online form for reporting a breach at your organization. The IPC says to report what you have and send more as you learn it. If you will be notifying a large number of people, it strongly recommends reporting first so it can help refine your notice plan.

Then notify the people affected. Direct notice by phone, letter, email or in person is preferred. Indirect notice, such as a prominent website notice, is for specific situations, for example when you cannot identify everyone affected. The notice must tell people they can complain to the IPC, and it must be in the prescribed form and manner (s. 30.1(4)). The IPC’s guidelines list what else to include: what happened and when, what information was involved, what you have done about it, steps people can take, and a contact at your institution who can answer questions.

After 48 hours: investigate, fix and record

The IPC’s last steps are to investigate the cause and reduce the risk of it happening again. Keep a record of every breach you report (s. 30.1(8)). The count goes into your annual report to the IPC. The first annual breach report for municipal institutions covers 2027 and is due March 31, 2028 (IPC FAQ).

Prepare before it happens

The IPC says every public institution should have a documented breach response plan that sets out who does what, who to contact and when, and how to stay prepared through practice exercises. If you use an outside service that holds personal information for you, make sure your contract requires it to tell you about a breach immediately: the IPC points out that the institution, not the contractor, is responsible for notifying people.