BC Freedom of Information and Privacy Association
Your Data Your Rights
What are the key steps to respond to privacy breaches as an organization?
The Manitoba Ombudsman, in reference to suggestions made by the Office of the Information and Privacy Commissioner of Alberta, has developed a guidance sheet on how to respond to privacy breaches which will be relevant for any jurisdiction.
Summary of the key steps:
- Containing the Breach
- Change passwords + two-factor verification
- Contact the office in charge of online privacy
- Stop any further communications
- Delete any files added to your device
- Evaluate the risks associated with the breach
- Evaluate the following factors
- Sensitivity
- Probability of harm
- Causes and extent of the breach
- Individuals affected by the breach
- Security of the personal or personal health information
- Evidence of harm from the breach
- Evaluate the following factors
- Notify and Report
- Notify individuals and reporting to the OIPC
- Prevent Future Breaches
- Physical safeguards – locked cabinets or doors, alarms, visitor access
- Technical safeguards – encryption, passwords, user access
- Administrative safeguards – review of policies, privacy training
Please see the Manitoba Ombudsman’s guiding document for more details.
Updated 2024.07. 27
These pages were last updated and reviewed in the summer of 2024.
The information on these pages only contains general information and guidance; none of the information constitutes legal advice. If you have a specific issue that you believe is a legal problem, the best practice is to consult a lawyer.
The information is non-partisan, dynamic and ever changing. It is the result of FIPA’s research and public education programs.
If you note something that needs to be added, corrected, or removed, please contact us by email: fipa AT fipa.bc.ca.
