Privacy breach assessment and notification support

Most privacy breaches start as an IT problem: a compromised Microsoft 365 mailbox, a ransomware event on a file server, a laptop left in a taxi, a misconfigured SharePoint link. The privacy question only becomes answerable once the technical facts are pinned down. What did the attacker actually reach? For how long? Was anything copied out, or only viewed? Were the files encrypted at rest?

Our work starts with the forensic record rather than assumptions. We preserve and review sign-in logs, the Microsoft 365 unified audit log, mailbox access records, endpoint telemetry and firewall data, then write down what the evidence shows and what it cannot show. That written account is what your counsel, your insurer and, if needed, a regulator will rely on, so we keep facts and inferences clearly separated.

If the incident is still active, containment comes first. Our digital forensics and incident response teams handle that side; this service picks up once the facts are stable enough to assess.

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), an organization must report a breach of security safeguards to the Office of the Privacy Commissioner of Canada (OPC) and notify affected individuals when it is reasonable to believe the breach creates a real risk of significant harm (RROSH). The Act lists the factors as the sensitivity of the information and the probability that it has been, is being or will be misused. Other regimes use their own tests: Quebec's private-sector law uses a 'risk of serious injury' test, Ontario's PHIPA sets out specific situations in which health custodians must notify the Information and Privacy Commissioner of Ontario (IPC), and Alberta's PIPA has its own commissioner-notification rule.

We supply the technical inputs those tests depend on: exactly which data types were exposed, whether encryption or access controls held, whether there is evidence of exfiltration, and whether the data has appeared anywhere it should not. Counsel makes the legal call; we make sure it rests on accurate facts.

Notification is only as good as the list behind it. A breached mailbox might hold ten years of attachments; a file share might contain spreadsheets nobody remembers creating. We build the list from the data itself:

• Identify the exact mailboxes, folders, sites or systems in scope, bounded by the dates the evidence supports.
• Search and extract the content using defensible methods, preserving hashes and an audit trail.
• Classify the personal information found (identifiers, financial, health, government ID numbers, credentials) so sensitivity can be assessed per person rather than per incident.
• De-duplicate individuals across sources and match them to the best available contact details.
• Flag records for residents of provinces with their own rules, such as Quebec, Alberta or British Columbia, so counsel can apply the right regime.
• Deliver a reviewed, versioned list with a methodology note that explains how it was built.

PIPEDA's Breach of Security Safeguards Regulations set out what a report to the OPC must contain, including a description of the circumstances, the date or period of the breach, the personal information involved, the number of individuals affected, the steps taken to reduce harm, and a contact person. Notices to individuals must describe the breach and the steps people can take to protect themselves. Quebec's Regulation respecting confidentiality incidents has its own list for notices to the Commission d'accès à l'information (CAI) and to affected people.

We draft the technical portions of these documents in plain language and check every factual statement against the evidence. Counsel owns the final wording and decides what is sent, when and to whom.

PIPEDA requires organizations to keep a record of every breach of security safeguards involving personal information under their control, whether or not it met the reporting threshold, and the regulations require those records to be kept for 24 months after the organization determines the breach occurred. Quebec requires a register of confidentiality incidents, with entries kept for at least five years. We produce a record entry for the incident we worked on and can help you set up a register for the smaller events that never become a full investigation.

We are a forensic and IT firm, not a notification vendor. We do not run call centres, print and mail large notice campaigns, or sell credit monitoring or identity-theft protection. When an incident needs those services, we tell you early so counsel or your insurer can arrange them, and we supply the clean list and the facts those providers need.

We also do not give legal advice. Breach decisions belong to your organization and its lawyers; our job is to make sure those decisions are based on what actually happened.