An incident in which personal information or other sensitive data is accessed, disclosed, or lost without authorization.
Data breaches can result from cyberattacks, human error, lost devices, or insider threats. Under PIPEDA, organizations must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner and notify affected individuals. Breach response plans should be prepared in advance.