Never miss a breach
notification deadline again
PIPEDA requires you to report a breach with a real risk of significant harm to the OPC as soon as feasible after you determine it has occurred. The law sets no fixed number of hours. Our incident log starts your response clock against a recommended 72 hour internal target, which is not a legal deadline, and walks you through every required step.
how long PIPEDA requires you to keep a record of every breach — reportable or not
1 PIPEDA Breach of Security Safeguards Regulations
Start Free AssessmentReport as soon as feasible. Start the clock now.
PIPEDA says to report a breach that creates a real risk of significant harm to the OPC as soon as feasible after you determine it has occurred. The law sets no fixed number of hours. Valdra starts your response clock against a recommended 72 hour internal target, which is not a legal deadline, and walks you through every required step.
Request a demoSubject: Important notice about your personal information
Dear [First Name],
We are writing to inform you of a security incident that may have affected your personal information held by [Company].
What happened: On [Date], we discovered that...
Every letter, every document, generated.
OPC notification letters, affected party notifications, and internal incident reports are drafted from your incident data in plain language, ready for your review in minutes, not hours.
Request a demoAdditional features
Request a demoAuto-Triggered Timer
Your response clock starts the moment an incident is logged, counting toward Valdra's recommended 72 hour internal target. That target is our recommendation, not a legal deadline.
Structured Incident Intake
Guided intake form captures all OPC-required details: nature of breach, personal information affected, number of individuals, risk of harm assessment.
Severity Classification
AI automatically classifies incident severity using OPC's real risk of significant harm (RROSH) criteria to determine notification obligations.
Team Assignment & Escalation
Assign incident investigation tasks to team members with deadline tracking. Auto-escalates to DPO if steps are not completed.
Evidence Preservation
Attach breach evidence, system logs, and investigation notes — all stored with tamper-evident timestamps for regulatory review.
Notification Letter Generation
Auto-generates OPC notification letters and affected individual notices using the incident data already captured in the log.
Frequently asked questions
When do I have to report a privacy breach to the OPC?
Under PIPEDA, you must report a breach to the Office of the Privacy Commissioner of Canada "as soon as feasible" once you determine it poses a real risk of significant harm (RROSH). Valdra starts the clock at intake, runs the RROSH assessment, and generates the OPC report and individual notification letters so you can meet the deadline with evidence.
What is RROSH?
RROSH — the Real Risk of Significant Harm — is the test that determines whether a breach is reportable under PIPEDA. It weighs the sensitivity of the information and the probability of misuse. Valdra walks you through a structured RROSH assessment and records the rationale for your breach file.
Get compliant and build trust
Start free, no credit card.
🍁 Canadian data residency · PIPEDA readiness · SOC 2 in progress
