Incident reporting: legal, regulatory and law enforcement obligations

When an incident involves personal information, regulated data, a public company or critical infrastructure, the organization will usually have legal duties to report it: to a regulator, to affected individuals, to investors, to customers under contract, or to a national cyber agency. These duties have their own definitions, thresholds and deadlines, and missing them can turn a manageable incident into an enforcement action. Reporting is therefore a core part of incident management, and the incident response plan must build the legal assessment into the process from the first hours.

This lesson maps the main obligations in Canada and the United States as of October 2026 and explains how to run the reporting decision as a process. CISSP-113 covered the broader legal and regulatory landscape, privacy principles and the governance of compliance; this lesson focuses on what happens to those obligations when an incident occurs.

Running the reporting decision as a process

Reporting duties typically turn on three questions: what happened (for example, unauthorized access to or disclosure of personal information), how serious it is (a harm threshold or materiality test), and when the clock started (often at discovery or at a determination that the threshold is met). Because these are legal judgments made on incomplete facts, the plan should assign a named person, usually the privacy officer working with counsel, to run a documented assessment as soon as an incident might involve regulated data. Every decision, including a decision not to report, should be recorded with the facts known at the time and the reasoning.

Multi-jurisdiction incidents are common: a Canadian company with US customers, or a US company with employees in Quebec, may face several sets of rules at once, each with different triggers and deadlines. A jurisdiction table prepared in advance, listing the rules that apply to the organization's data and the information each notice requires, saves time when the clock is running.

Privacy breach reporting

In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) has required breach reporting since 1 November 2018. An organization must report to the Office of the Privacy Commissioner of Canada (OPC) any breach of security safeguards involving personal information under its control if it is reasonable to believe that the breach creates a real risk of significant harm (RROSH) to an individual. It must also notify affected individuals, and notify any other organization or government institution that may be able to reduce the risk of harm, as soon as feasible after determining that a breach has occurred. Significant harm is defined broadly and includes bodily harm, humiliation, damage to reputation or relationships, financial loss, identity theft, negative effects on credit records and loss of employment or business opportunities. The two factors for assessing real risk are the sensitivity of the information and the probability that it has been, is being or will be misused.

PIPEDA also requires organizations to keep a record of every breach of security safeguards, whether or not it meets the RROSH threshold, for 24 months after the day the organization determined that the breach occurred, and to provide those records to the OPC on request. The Breach of Security Safeguards Regulations set the content of the report to the OPC and of notices to individuals, such as a description of the circumstances, the date or period, the information involved, the steps taken to reduce harm and a contact point. Alberta's Personal Information Protection Act has a similar requirement to notify the Alberta commissioner where there is a real risk of significant harm.

In Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, uses the term confidentiality incident. Since 22 September 2022, an organization must promptly notify the Commission d'accès à l'information and affected persons when an incident presents a risk of serious injury, and must keep a register of all confidentiality incidents, which the Commission can request. The assessment considers the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used for harmful purposes. Organizations operating in Quebec should keep the PIPEDA record and the Law 25 register aligned, since one incident often needs to appear in both.

Health and financial sector reporting

Several Canadian sectors have their own incident reporting rules. Federally regulated financial institutions must report technology and cyber security incidents to the Office of the Superintendent of Financial Institutions (OSFI) under its Technology and Cyber Security Incident Reporting advisory, within 24 hours or sooner where possible, with regular updates. Provincial health information laws, such as Ontario's Personal Health Information Protection Act, require custodians to notify individuals and, in defined cases, the provincial commissioner when health information is stolen, lost or used or disclosed without authority. Securities regulators expect reporting issuers to disclose material information, including the effects of a significant cyber incident, under continuous disclosure rules.

For publicly listed Canadian companies, cyber incidents also raise disclosure questions under provincial securities law. The Canadian Securities Administrators have issued guidance that issuers should consider whether a cyber attack is a material change requiring prompt news release and filing, and should describe cyber security risks in their disclosure documents. Many Canadian issuers are also listed in the United States and must follow the SEC rules as well.

Critical infrastructure reporting

Bill C-8, which received royal assent on 16 June 2026, enacts the Critical Cyber Systems Protection Act. Once its regulations are in force, designated operators in federally regulated sectors such as finance, telecommunications, energy and transportation will have to establish cyber security programs and report cyber security incidents to the Communications Security Establishment, which operates the Canadian Centre for Cyber Security, within a period to be set by regulation (checked October 2026). CISSP-113 covers the Act in more detail. Until then, operators are encouraged to report voluntarily to the Cyber Centre.

Law enforcement and national agencies

Cybercrime in Canada can be reported to the local police service and through the national online reporting system operated by the RCMP's National Cybercrime Coordination Centre (NC3) with the Canadian Anti-Fraud Centre. The Canadian Centre for Cyber Security (CCCS) accepts incident reports from organizations and provides advice and, for significant incidents, coordination. Reporting to the Cyber Centre is a separate step from reporting to the OPC; the Cyber Centre is not a privacy regulator. Before sharing evidence with police, organizations should agree with counsel what is provided and how chain of custody will be maintained, as Lesson 2 described.

Engaging law enforcement early has benefits: investigators may already know the adversary, may be able to help recover funds in fraud cases if contacted within hours, and may provide threat information. Involving them does not mean surrendering control of the response, and law enforcement in both countries generally works to minimize disruption to victims. In some cases investigators may ask an organization to delay public notification to protect an investigation; most notification laws allow for that delay when requested by law enforcement, but the request should be documented.

Calculating deadlines

Deadlines expressed in hours, calendar days or business days, starting from different trigger points, are easy to miscalculate under pressure. A simple calculator, maintained by counsel and included in the plan, helps the incident manager see all the clocks on one page.

from datetime import date, datetime, timedelta
# Notification clocks for one synthetic incident; triggers and deadlines vary by rule and need legal advice
holidays = {date(2026, 11, 11), date(2026, 11, 26)}
def add_business_days(d, n):
    while n:
        d += timedelta(days=1)
        if d.weekday() < 5 and d not in holidays:
            n -= 1
    return d
discovered = date(2026, 11, 6)                       # Friday
significant_determined = datetime(2026, 11, 6, 15, 0)
materiality_determined = date(2026, 11, 10)          # Tuesday
clocks = [
    ('Banking regulator, 36 hours from determination (US)', (significant_determined + timedelta(hours=36)).strftime('%Y-%m-%d %H:%M')),
    ('SEC 8-K Item 1.05, 4 business days after materiality (US)', add_business_days(materiality_determined, 4).isoformat()),
    ('GLBA Safeguards, FTC notice within 30 days (US)', (discovered + timedelta(days=30)).isoformat()),
    ('HIPAA outer limit, 60 calendar days (US)', (discovered + timedelta(days=60)).isoformat()),
    ('PIPEDA, as soon as feasible (Canada)', 'no fixed day: act promptly'),
]
for name, due in clocks:
    print(f'{name:58s} {due}')

Banking regulator, 36 hours from determination (US)        2026-11-08 03:00
SEC 8-K Item 1.05, 4 business days after materiality (US)  2026-11-17
GLBA Safeguards, FTC notice within 30 days (US)            2026-12-06
HIPAA outer limit, 60 calendar days (US)                   2027-01-05
PIPEDA, as soon as feasible (Canada)                       no fixed day: act promptly

Note that the SEC deadline skips the weekend and a US federal holiday, and that rules phrased as as soon as feasible or without unreasonable delay have no safe harbour date: regulators expect organizations to move as fast as the facts allow, and outer limits are maximums, not targets.

# A structured real-risk-of-significant-harm style assessment (illustrative scoring, not a legal test)
sensitivity = {'contact details': 1, 'account number': 2, 'government ID': 3, 'health information': 3, 'credentials': 3}
probability = {'encrypted, key safe': 0, 'lost device, no evidence of access': 1, 'sent to wrong trusted recipient, confirmed deleted': 0,
               'accessed by unknown party': 2, 'posted publicly or ransomed': 3}
cases = [
    ('Laptop lost, full disk encryption on', 'government ID', 'encrypted, key safe'),
    ('Email with health details sent to wrong clinic, deleted', 'health information', 'sent to wrong trusted recipient, confirmed deleted'),
    ('Customer portal accessed with stolen passwords', 'account number', 'accessed by unknown party'),
    ('HR files posted on extortion site', 'government ID', 'posted publicly or ransomed'),
]
for desc, data, prob in cases:
    s, p = sensitivity[data], probability[prob]
    verdict = 'likely notifiable: consult counsel' if s * p >= 4 else ('borderline: document and consult counsel' if s * p >= 2 else 'likely not notifiable: record it')
    print(f'{desc:55s} sensitivity {s} x probability {p} = {s*p}  {verdict}')

Laptop lost, full disk encryption on                    sensitivity 3 x probability 0 = 0  likely not notifiable: record it
Email with health details sent to wrong clinic, deleted sensitivity 3 x probability 0 = 0  likely not notifiable: record it
Customer portal accessed with stolen passwords          sensitivity 2 x probability 2 = 4  likely notifiable: consult counsel
HR files posted on extortion site                       sensitivity 3 x probability 3 = 9  likely notifiable: consult counsel

The scoring is a way of documenting thinking, not a legal test, and counsel should review any borderline case. Even incidents assessed as not notifiable must be recorded: in Canada under the PIPEDA 24-month record-keeping rule and the Law 25 register, and in the United States in an internal register that regulators may request.