Breach of Security Safeguards Regulations (SOR/2018-64)

Marginal note:Contents of notification

3 A notification provided by an organization, in accordance with subsection 10.1(3) of the Act, to an affected individual with respect to a breach of security safeguards must contain

• (a) a description of the circumstances of the breach;

• (b) the day on which, or period during which, the breach occurred or, if neither is known, the approximate period;

• (c) a description of the personal information that is the subject of the breach to the extent that the information is known;

• (d) a description of the steps that the organization has taken to reduce the risk of harm that could result from the breach;

• (e) a description of the steps that affected individuals could take to reduce the risk of harm that could result from the breach or to mitigate that harm; and

• (f) contact information that the affected individual can use to obtain further information about the breach.