Report a privacy breach at your federal institution

Federal institutions subject to the Privacy Act are required to:

• report material privacy breaches to the Treasury Board of Canada Secretariat (TBS) and the Office of the Privacy Commissioner of Canada (see appendix A of the Policy on Privacy Protection),
• notify TBS of any potential or confirmed privacy breach that could affect multiple institutions, and respond to direction, advice or information requests issued by TBS regarding such breaches, and
• respond to information requests from the OPC about privacy breaches.

Federal institutions must also notify the OPC of the measures undertaken to reduce the impact of the breach when it involves sensitive personal information and could reasonably be expected to cause a real risk of significant harm to the individual.

Submit your privacy breach report online

Note: The secure online breach reporting form allows you to submit breach reports and related documents to both the OPC and TBS at the same time.

Use this secure online form to:

• Submit a report of a new privacy breach as well as documents related to the breach report.

Note: If you have completed a privacy breach risk self-assessment, you can include the results (in PDF format) with your breach report

• Add documents to existing breach reports when you are following up with further information and already have a temporary tracking number or a file number

The breach report will help determine the type of intervention that is required by the OPC, such as an informal discussion or an investigation.

Other ways to report a breach

You can also submit a breach report using the Privacy Act Material Breach Report Form that is available in PDF format.

Submitting your completed PDF form

Submit your completed breach report (in PDF format) using the online breach reporting form.

1. On the Request a link to submit a breach report screen, enter your email address and select the Submit button.
2. You will receive an email from nepasrepondre-noreply@priv.gc.ca containing a link to access the Privacy Act breach reporting form. Select the Access the OPC’s secure breach reporting form link.
3. On the Original report screen, select Original Report and then select Next. Select Upload a completed breach report form option and select Next.
4. On the Upload breach report and supplementary information screen, follow the prompts to update the completed form and related documents. Select Next.
5. On the Confirmation screen, check the box to certify that you have not entered any personal information in this form. Select Next.
6. On the Preview screen, review the information you have entered and make any edits required. Select the Submit button to submit the breach report.
7. On the final screen, under Download a copy of the breach report, select the Download button to obtain a copy of your report.