A Data Breach at Your Business: What the Law Requires You to Do, and Who to Tell

A stolen laptop, a hacked customer file, an email sent to the wrong address. These things happen, and they are not just an IT problem. The moment a customer's personal information, including anything tied to a payment, gets exposed without authorization, a specific law applies. It spells out what a business has to do, in what order, and who it has to tell.

What the law calls a confidentiality incident

Quebec's Act respecting the protection of personal information in the private sector, usually called Law 25, defines a confidentiality incident broadly. According to the Commission d'accès à l'information du Québec, it covers any unauthorized access to personal information, any unauthorized use or disclosure of it, any loss of it, or any other breach of its protection. A stolen terminal, a customer list emailed to the wrong person, or a file an employee looked at without a work reason to do so all fall under that definition.

The test that decides whether you have to report it

Not every incident gets handled the same way. The law requires a formal report only when the incident presents a risk of serious injury to the people affected. To weigh that risk, the Commission points to three factors considered together: how sensitive the exposed information is, the consequences that can reasonably be expected from its use, and how likely it is to be used for a harmful purpose. A card number exposed together with a customer's name and address weighs far more in that assessment than a name on a promotional mailing list.

What to do the moment you find out

Once you discover an incident, the order of the steps matters as much as the steps themselves. Contain it first: isolate the affected device or system, revoke any compromised access, recover whatever can still be recovered. Then assess the risk against the three factors above, writing the assessment down as the facts come in rather than after the fact.

If that assessment points to a risk of serious injury, two separate notifications are required:

• to the Commission d'accès à l'information, in writing, using the declaration form set up for that purpose on its website
• to every person whose information was affected, in a message explaining what happened and what they can do to protect themselves

The law does not set a fixed number of days, but it requires acting without delay once the risk is established. Waiting for an internal investigation to wrap up completely before telling anyone is not a valid reason to hold off.

A register, even when nothing looks serious

Law 25 goes further than reporting the serious cases. It requires every business to keep a register of all confidentiality incidents, including the ones that do not reach the risk of serious injury threshold. A laptop stolen and recovered intact the next day, an email sent to the wrong person but pulled back in time: both still belong in the register. The Commission can ask to see it at any time, and not having one is itself a violation, separate from whatever incident triggered the question.

Why this isn't optional

The Commission d'accès à l'information can impose administrative monetary penalties on a business that fails to report an incident presenting a risk of serious injury, to the Commission or to the people affected. Those administrative penalties can reach 10 million dollars or 2 percent of the organization's worldwide revenue from the prior fiscal year, whichever is higher, and separate penal prosecutions can go up to 25 million dollars or 4 percent of that revenue. Those ceilings are aimed at large organizations, but the law sets no size threshold for the underlying duty itself. A small shop is bound by it the same way a large chain is.

If your customers are elsewhere in Canada

A business that sells online to customers in other provinces can also fall under the equivalent federal law, the Personal Information Protection and Electronic Documents Act. The Office of the Privacy Commissioner of Canada applies a similar but distinct test, the real risk of significant harm, which weighs the sensitivity of the information, who accessed it, how long it was exposed, and whether there is evidence of malicious intent. Both regimes can apply to the same incident at the same time. Reporting to the Quebec Commission does not by itself cover a federal report if the federal test is also met, and the reverse is just as true.

What to check right now

The best time to read these rules is not the day a device goes missing or an email lands in the wrong inbox. Check now who in your business would be responsible for spotting an incident, weighing the risk against the Commission's three factors, and filing the declaration form if the threshold is met. An empty register is not proof that nothing happened. Most of the time, it is only proof that nobody has gotten around to starting one.