Incident, Breach, or Neither? The Triage Call That Decides Your Reporting Duty

Three questions, in strict order, decide what you owe: was there unauthorised access to or loss of personal information, does it create a real risk of significant harm, and does a contract or another regime impose a duty regardless. Most organizations collapse these into one anxious conversation and get the answer wrong in both directions, over-reporting trivia and under-reporting the thing that mattered.

Run them in sequence and the call becomes defensible even when it turns out to be wrong.

Question one: is this a breach of security safeguards at all?

An incident is anything unexpected. A breach, in the PIPEDA sense, involves unauthorised access to or disclosure of personal information, or its loss, resulting from a failure of your security safeguards.

Things that are incidents but usually not breaches: a phishing email nobody clicked, a laptop misplaced then found in the same building, a system outage with no data exposure, an employee accessing a record they were entitled to access for a purpose you dislike. That last one is a conduct issue and possibly a use limitation problem, but it is not automatically a safeguards breach.

Things people wrongly dismiss: an email with the wrong recipient, a misconfigured sharing link, a departed employee's account still active, a backup exposed on an unsecured endpoint. All of these are unauthorised access or disclosure, and all of them get talked out of the breach category with alarming regularity.

Question two: is there a real risk of significant harm?

This is the reporting test under PIPEDA, and it is assessed on two axes together: how sensitive the information is, and how likely it is to be misused.

Sensitivity is not just about the field names. A list of email addresses is low sensitivity in isolation and high sensitivity if the list is the client roster of an addiction clinic. Context does most of the work, which is why a template scoring sheet fails and a short written analysis succeeds.

Probability of misuse turns on facts you can often establish quickly: was the exposure targeted or accidental, was it retrieved and by whom, how long was it open, was it encrypted, and is there evidence of access. A misdirected email to a known recipient who confirms deletion is a different probability from a public link indexed by a search engine.

Note the last row. Absence of logs is not evidence of absence, and treating it as such is the most common way an assessment goes wrong.

Question three: does something else require reporting anyway?

Even where the harm test is not met, other duties can bite. Quebec's Law 25 carries its own confidentiality incident regime with its own register. Health information is governed provincially, with PHIPA in Ontario setting different expectations for custodians. Contracts frequently commit you to notifying a customer of any security incident affecting their data, with no harm threshold at all and a clock measured in hours.

That contractual clock is the one that catches companies out. Your DPA may require notice within twenty-four or forty-eight hours of becoming aware, which is often faster than your internal investigation concludes. Read that clause before the incident, not during it.

Who should make the call?

A named person with the authority to decide, supported by two others, and never the person who caused the incident.

In a small company this is usually the privacy lead plus a technical person who can establish facts and someone from the business who understands the affected relationship. What matters is that the decision is not made by consensus drift at four in the afternoon on a Friday. Name the decider in advance and write the decision down when it is made.

Why log the incidents that turn out to be nothing?

Because your judgement is only credible if it is exercised consistently, and because PIPEDA requires records of every breach of security safeguards regardless of whether it was reportable.

A breach register containing two entries, both of which you reported, invites an obvious question: are these really the only two things that happened in three years? A register with forty triaged incidents, of which thirty-seven were assessed as not creating a real risk of significant harm with a written reason and three were reported, demonstrates a functioning process. The second organization is in a far stronger position, and the difference is only record-keeping.

Log the near misses too. They are the cheapest source of control improvement you will ever have, and they cost nothing to record in an incident log at the moment they happen.

For the reporting mechanics once the call is made, PIPEDA breach reporting and what actually triggers a report covers the obligation itself, and how to write a breach notification letter covers the notice.

This is general information, not legal advice.

Valdra keeps the triage questions, the written rationale, the register, and the notification workflow in one place, so the decision and its evidence are recorded at the moment it is taken.