Who to tell after a cyber incident in Canada

Report the incident to the Canadian Centre for Cyber Security through its online reporting form, and to your local police in an emergency or where a crime occurred. Fraud also goes to the Canadian Anti-Fraud Centre. If personal information was involved and there is a real risk of significant harm, PIPEDA requires a report to the Privacy Commissioner of Canada.

Before deciding who else to tell, bring in legal counsel and notify your cyber insurer. Counsel can direct the investigation and decide what must be reported, when, and how it is worded. Most cyber policies require prompt notice and some require you to use particular vendors or obtain consent before incurring costs. Reporting to anyone else is not usually urgent enough to skip these two calls, and early statements to third parties are hard to take back.

Then preserve evidence. Most of the reports below ask what happened, when, what data was involved and how many people are affected. You can only answer accurately if logs, mailboxes and affected devices have been preserved.

If personal information is involved, one or more privacy regulators may need a report. The main regimes:

Cybercrime is crime. Report to your local police service, and to 911 if there is any threat to life or safety. Nationally, the RCMP launched the Report Cybercrime and Fraud system (reportcyberandfraud.canada.ca) in November 2025. It is run by the RCMP's National Cybercrime Coordination Centre (NC3) and the Canadian Anti-Fraud Centre (CAFC) and serves as a central repository for reports from individuals, businesses and organizations. Reports can include evidence such as screenshots, transaction records and emails. The CAFC also takes reports by phone at 1-888-495-8501 on weekdays.

If money has been sent to a fraudster, for example after a business email compromise, call your bank immediately as well. Speed matters for any chance of recalling or freezing funds.

The Canadian Centre for Cyber Security (the Cyber Centre), part of the Communications Security Establishment, accepts cyber incident reports through its online portal at cyber.gc.ca. It uses reports to understand threats, help victims and warn others. Two points from its own reporting page are worth knowing: reporting to the Cyber Centre does not launch a law enforcement investigation, so report crimes to police as well; and you should not complete the form on a network or device you believe is compromised.

Beyond your cyber insurer, look for contractual obligations. Common sources are client contracts and data processing agreements (often with short notice windows), payment card agreements, partner and supplier agreements, lender covenants and public-sector contracts. Under PIPEDA you must also notify other organizations or government institutions that may be able to reduce the risk of harm to affected individuals, such as a bank or card issuer, when you notify individuals.

• Federally regulated financial institutions: OSFI's Technology and Cyber Security Incident Reporting Advisory requires a written report to OSFI's Technology Risk Division and the Lead Supervisor within 24 hours, or sooner if possible.
• Law firms: law society rules can require reports on loss of records or client property. In BC, for example, the Law Society's cloud guidance points to a written report to the Executive Director under Rule 10-4(2) and notice to the Lawyers Indemnity Fund.
• Regulated health professionals: health colleges may have their own expectations, and PHIPA requires custodians to notify the IPC where a breach leads to discipline of a college member.
• Other sectors, such as securities, energy and telecommunications, can have their own reporting rules. Check with counsel or your regulator.

Put this table, with real names and phone numbers, into your incident contact sheet before you need it.