If a breach of security safeguards exposes personal information your brokerage controls, and it is reasonable to believe the breach creates a real risk of significant harm to a person, PIPEDA requires you to report it to the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible. You must also keep a record of every breach, including the ones you do not report. This guide walks through each step in the order a brokerage lives it, with the mortgage file in mind: income documents, ID, bank statements, credit reports.
TL;DR
- Report to the Office of the Privacy Commissioner of Canada (OPC) and notify individuals when a breach creates a real risk of significant harm. Both steps happen as soon as feasible after you determine the breach occurred.
- Judge risk on two things: how sensitive the information is and how likely it is to be misused. Mortgage files score high on sensitivity.
- Keep a record of every breach for 24 months, reportable or not.
- Alberta, British Columbia and Quebec have their own private-sector privacy laws, with their own regulators and wording.
- Deliberately failing to report, notify or keep records can be an offence with fines of up to $100,000.
Table of Contents
- What PIPEDA actually requires
- Deciding whether the risk is "real" and "significant"
- How fast you must act
- What goes in the report to the OPC
- What goes in the notice to individuals
- Keeping the breach record
- A response routine for a brokerage
- When Alberta, BC or Quebec law applies
- What non-compliance can cost
- Reducing the odds of a reportable breach
- Our perspective
- How Autowrite fits into your breach readiness
- FAQ
- Sources
What PIPEDA actually requires
The duty sits in section 10.1 of PIPEDA. An organization must report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. The same section requires notification of the affected individuals.
Three phrases carry the weight:
- Breach of security safeguards. Loss of, or unauthorized access to or disclosure of, personal information that results from a failure of your safeguards. A laptop left on a train, a misdirected email carrying a client's file, a compromised email account, a phishing click that gives someone access to your document folder: these are the day-to-day versions.
- Under its control. In a brokerage, the information you collect from borrowers is under your control even when a vendor stores or processes it for you. Your accountability does not move to the vendor.
- Real risk of significant harm. The threshold that decides whether you report. The next section covers it.
A breach that does not meet the threshold is still a breach. You still record it.
Deciding whether the risk is "real" and "significant"
PIPEDA does not hand you a checklist. It tells you to look at two factors: the sensitivity of the information involved, and the probability that it has been, is being or will be misused. Both come from section 10.1.
The Act also defines significant harm broadly. It includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property.
Why mortgage files start high on sensitivity
A typical application package holds a full name, address, date of birth, Social Insurance Number, employer details, pay stubs, T4s, Notices of Assessment, bank statements and credit bureau information. Put those in the wrong hands and several harms on the statutory list become plausible: identity theft, financial loss and damage to the credit record. For that reason, a brokerage should assume that exposure of a full file is serious on the sensitivity side, and spend its assessment time on the second factor.
Probability of misuse: questions to ask
These are working questions, not statutory tests. They help you reason about the probability factor and write down why you reached your conclusion:
- Who received or could reach the information? A known colleague who deleted the email is a different case from an unknown external party or a criminal actor.
- Was the information protected, for example by encryption or a password the recipient lacked?
- Is there evidence it was actually opened, copied or used?
- Has the information been recovered, and can you confirm no copies exist?
- Is there any sign of malicious intent, such as a targeted attack, rather than a simple mistake?
Write the answers down at the time. If you later decide not to report, that record is what shows how you decided.
Worked examples
Example 1: wrong recipient. An assistant emails a borrower's bank statements to the wrong external address. The address belongs to a stranger and the message was not recalled. The information is highly sensitive and the recipient is unknown and outside your control. Many brokerages would treat this as meeting the threshold unless they can confirm deletion from a reliable source. Assess it and decide with documented reasons.
Example 2: internal slip. A file is sent to another licensed colleague within your brokerage who should not have had access. The colleague confirms in writing that it was deleted unread. Sensitivity is high, but the probability of misuse may be low. You would record the breach, the facts and your reasoning.
Example 3: compromised mailbox. A broker's email account is taken over, and the attacker has access to months of attachments. Sensitivity is high and the probability of misuse is hard to rule out. This is the scenario that most clearly points toward reporting and notifying.
These are illustrations of reasoning, not rulings. When in doubt, many privacy professionals lean toward treating the risk as real, and a privacy lawyer can confirm your view on a specific incident.
How fast you must act
Both the report to the OPC and the notice to affected individuals must be made as soon as feasible after you determine that the breach has occurred, per section 10.1. There is no fixed number of hours or days. "As soon as feasible" means you cannot sit on the facts while you debate. Containment and assessment come first and should run at once, but the clock on reporting and notification is about moving promptly once you know a reportable breach occurred.
In practice, that means a brokerage should know before an incident happens who decides, who contacts the OPC, and who writes to clients. The OPC's own guidance on privacy management says organizations should have a breach procedure and a person responsible for managing it, noting that breaches are costly and can damage consumer trust. For larger organizations it suggests a collaborative approach, with responsibilities for internal and external breach reporting made clear.
What goes in the report to the OPC
The Breach of Security Safeguards Regulations set the content. A report to the Commissioner must be in writing and include:
- the circumstances of the breach and, if known, its cause;
- the day or period in which it occurred;
- a description of the personal information involved;
- an estimate of the number of individuals affected;
- the steps taken to reduce the risk of harm and to notify individuals;
- the name and contact details of a person who can answer the Commissioner's questions.
The report may be sent by any secure means of communication. Have your facts ready in that structure from the first hour of the incident, and your later report becomes a matter of assembling what you already logged. If you want a way to think about the level of detail that regulators and customers expect, a plain-language reference on security and data handling practices shows how organizations describe what they protect and how.
What goes in the notice to individuals
The same Regulations require that a notice to an affected person contain enough information for them to understand the breach and act. It describes:
- the circumstances of the breach;
- when it occurred;
- the personal information involved;
- the steps you have taken to reduce the risk of harm;
- the steps the individual can take to reduce risk or mitigate harm;
- contact information so they can ask questions.
Direct notice can be given by telephone, mail, email or another appropriate means. For a borrower, a phone call followed by a written confirmation is often the clearest approach, since you already know how they prefer to be reached. Plain words matter here: say which documents were involved, not just "personal information", so the client knows whether to watch their credit file, call their bank, or both.
Keeping the breach record
PIPEDA's record obligation catches many small organizations out. Under the Regulations, you must keep a record of every breach of security safeguards involving personal information under your control, for 24 months after the day you determine the breach occurred. That includes breaches you concluded were below the harm threshold. The record must let the Commissioner verify that you complied with the reporting and notification requirements.
A useful log entry contains:
| Field | What to capture |
|---|---|
| Date discovered and date determined | Two dates, because the 24 months run from the determination |
| What happened | Plain description and, if known, cause |
| Information involved | Document types and fields, not copies of the documents |
| People affected | Number and, internally, who they are |
| Risk assessment | Sensitivity, probability of misuse, your conclusion and reasoning |
| Decision | Reported to OPC, notified individuals, or not, and why |
| Actions taken | Containment, remediation, dates |
| Owner | The person accountable for the incident |
A brokerage that keeps its files in a structured system finds this easier, because it can see which documents sat in which deal. More on that in the audit-ready digital compliance records guide on our blog.
A response routine for a brokerage
The OPC's 2010 audit of selected mortgage brokers describes the logic of a breach response for brokerages: contain the breach and make a preliminary assessment, evaluate the risks, notify those affected, and prevent recurrence. It also points to the groundwork: privacy policies and procedures, a named person responsible for privacy, and staff training on their responsibilities. Applied to a brokerage today, that becomes a routine like this:
- Contain. Cut access, recall the message, reset credentials, retrieve the device. Note the time.
- Assess. Identify what documents were involved and whose they are. Apply the sensitivity and probability factors.
- Decide. Does it create a real risk of significant harm? Write down the decision and the reasons.
- Report and notify. If yes, report to the OPC and tell individuals as soon as feasible, using the content lists above.
- Record. Add the entry to your breach log whatever the decision.
- Prevent. Fix the cause: access rights, email habits, device encryption, vendor controls, training.
Our PIPEDA compliance checklists for mortgage brokers cover the preparation side in more depth.
When Alberta, BC or Quebec law applies
PIPEDA is not the only breach rule a Canadian broker may face. British Columbia, Alberta and Quebec have private-sector privacy laws deemed substantially similar to PIPEDA, according to the OPC's accountability guidance. In those provinces, the provincial law generally governs an organization's in-province handling of personal information. PIPEDA continues to apply to federal works, undertakings and businesses, and to personal information that flows across provincial or national borders in commercial transactions. Brokerages in Ontario are not covered by a substantially similar provincial private-sector law for this purpose, so PIPEDA is the main framework there.
| Province | Who you report to | Trigger described in the sources |
|---|---|---|
| Federal / Ontario | Office of the Privacy Commissioner of Canada | Real risk of significant harm |
| Alberta | Alberta's Information and Privacy Commissioner | Incident involving loss of, or unauthorized access to or disclosure of, information, where a reasonable person would consider there to be a real risk of significant harm; notify without unreasonable delay |
| Quebec | Commission d'accès à l'information | Confidentiality incident presenting a risk of serious injury; written notice with the content set by regulation |
| British Columbia | Substantially similar law applies; confirm current breach duties with the provincial regulator | See the regulator's guidance |
The Alberta wording comes from the OPC's accountability guidance. For Quebec, the Regulation respecting confidentiality incidents requires written notice to the Commission d'accès à l'information of an incident that presents a risk of serious injury, including the information the regulation specifies. Brokers who work across provinces, or hold files for borrowers in several, should map which regime governs each file and write one procedure that satisfies the strictest.
What non-compliance can cost
Deliberately failing to report a breach, notify individuals, or keep breach records as required can be an offence subject to fines of up to $100,000. Beyond fines, an unreported incident that surfaces later damages the relationship with the client and with lenders and your regulator. The OPC's 2010 mortgage broker audit makes the point that notification demonstrates good privacy practice and builds trust.
Reducing the odds of a reportable breach
Most brokerage breaches are mundane. They come from documents moving by email, shared folders with loose permissions, and copies saved in places nobody tracks. A few controls remove much of that exposure:
- Collect documents through one controlled intake instead of ad hoc email threads.
- Limit who can open which deals, and review access when people leave.
- Encrypt devices and use multi-factor authentication on email and your file systems.
- Know where your vendors store data. We explain the question in Does Canadian data residency actually have to stay in Canada?.
- Review what is exchanged when your tools sync with your mortgage software. Our guide on privacy controls for mortgage data syncing lists six.
- Train staff on the incident routine until "tell the privacy lead right away" is reflex.
Our perspective
We built Autowrite for Canadian mortgage brokers because the paperwork is where privacy risk lives. Every time a pay stub or bank statement is forwarded, downloaded and re-saved, there is another copy to lose and another trail to explain.
Our view is that breach readiness is mostly a document-handling problem. If intake, classification and extraction happen in one purpose-built platform, with Canadian data residency and a clear record of what sits in each file, a brokerage can answer the questions a breach raises quickly: what was involved, whose is it, who had access. That is exactly the information the OPC report and the client notice call for.
We designed Autowrite to cut the manual handling of documents, which is where many incidents begin, and to give brokers a structured file they can point to when the 24-month record has to stand up. The law does not ask for perfection. It asks for safeguards, a prompt and honest response, and records. A system that organizes the file does most of the groundwork for all three.
Anant Bawa
How Autowrite fits into your breach readiness
Autowrite is an AI-powered operating system for Canadian mortgage brokers. It handles document intake, classification and data extraction, assembles e-sign and compliance packages, and keeps Canadian data residency. Plans are billed monthly: Starter is $99 per month, Pro is $199 per month and Legend is $399 per month, with an Enterprise plan that has no published price. Additional deals are $20 each, and a pay-as-you-go option is $35 per deal. Paid plans come with a 14-day free trial.
See the plans on our pricing page, or start from the Autowrite homepage to try it on your own workflow.
FAQ
Do I have to report every breach to the OPC?
No. You must report to the OPC only when it is reasonable in the circumstances to believe the breach creates a real risk of significant harm. You must still record every breach of security safeguards and keep that record for 24 months.
How quickly must I notify clients?
As soon as feasible after you determine that the breach has occurred. PIPEDA sets no fixed number of days, so contain the incident and assess it at once, then report and notify without delay.
How should I send the report to the OPC?
The report must be in writing and may be sent by any secure means of communication. Include the circumstances and cause, timing, information and number of people affected, the steps taken, and a contact person.
Does PIPEDA apply if my brokerage is in Alberta, BC or Quebec?
In most in-province situations, the substantially similar provincial law applies instead, and Quebec requires notice to the Commission d'accès à l'information. PIPEDA still applies to federal works and to information crossing provincial or national borders in commercial transactions.
How long do I keep breach records?
Keep a record of every breach for 24 months after the day you determined it occurred. The record must let the Commissioner verify that you met the reporting and notification requirements.
Sources
- Personal Information Protection and Electronic Documents Act, section 10.1
- Breach of Security Safeguards Regulations
- Audit of Selected Mortgage Brokers (2010), Office of the Privacy Commissioner of Canada
- Getting Accountability Right with a Privacy Management Program, OPC
- How the OPC protects and promotes privacy
- Règlement sur les incidents de confidentialité, RLRQ c A-2.1, r 3.1
- Order Fixing November 1, 2018 as the Day on which Certain Provisions Come into Force, Canada Gazette