News release Privacy Commissioner launches breach risk selfassessment tool for organizations Office of the Privacy Commissioner of Canada

pMarch 26 2025 Gatineau QuebecppPrivacy Commissioner of Canada Philippe Dufresne has launched a new online tool that will help businesses and federal institutions that experience a privacy breach to assess whether the breach is likely to create a real risk of significant harm to individualsppThe privacy breach risk selfassessment tool is a convenient webbased application that guides users through a series of questions to assess the sensitivity of personal information that is involved in a data breach and the probability that it will be misusedppThe results provided through this online tool will help organizations to conduct a risk assessment following a data breach and determine their required next steps including notifying affected individualsppOrganizations that are subject to Canadas federal privatesector privacy law the Personal Information Protection and Electronic Documents Act PIPEDA and federal government institutions are required to report breaches that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to notify affected individualsppReal risk of significant harm includes bodily harm humiliation damage to reputation or relationships loss of employment financial loss identity theft negative effects on ones credit record and damage or loss of propertyppIn determining whether there is a real risk of significant harm organizations must consider the degree of sensitivity of the personal information involved and the probability that the information will be misusedppPrivacy breaches may result from identity theft scams hacking or other unauthorized access be it deliberate or accidental Sensitive information often includes personal health and financial datappPrivacy breaches are growing in scale complexity and severity and can cause serious harm to the people who have been affected This new online tool will make it easier for organizations to assess the potential impacts on individuals who have been affected to determine what steps they need to take following a breachppPhilippe DufresnePrivacy Commissioner of CanadappOffice of the Privacy Commissioner of CanadacommunicationsprivgccappThe Privacy Commissioner of Canada is an Agent of Parliament whose mission is to protect and promote privacy rightsppGet updates about the OPCs announcements and activities as well as the events in which we participateppWe respect your privacyppRead our Privacy policy and Terms and conditions of use to find out more about your privacy and rights when using the privgcca website or contacting the Office of the Privacy Commissioner of CanadappIf you have a question concerns about your privacy or want to file a complaint against an organization we are here to helpp