News and Analysis

Canadian organizations are obliged to report cyber security breaches in certain circumstances under the Personal Information Protection and Electronic Documents Act. Whilst many benefits can come from reporting, like triggering criminal investigations and deterring further attacks, several drawbacks exist. These include potential public exposure that could damage reputation, resource intensity to support the investigation, limited control over the investigation process, and potential exposure of sensitive data. Organizations are encouraged to consult with legal counsel to make informed decisions on handling cyber security breaches.