This page explains the Personal Information Protection Commission's procedures for responding to personal data breaches and reporting obligations. Organizations must report breaches promptly; those involving unlawful purposes must be reported within 60 days. Reporting is mandatory for breaches involving sensitive personal information (race, medical history, criminal records), data that could cause financial harm if misused, breaches from unlawful acts, or breaches affecting over 1,000 individuals (100 for administrative agencies). Examples include medical information leaks, credit card number exposure, unauthorized access, ransomware attacks, and document theft.
