A privacy (confidentiality) incident is any unauthorized access to, use of or disclosure of personal information, or its loss. If one happens in your small business, you must act to limit the harm, assess the risk of serious injury, notify the Commission d’accès à l’information (CAI) if that risk exists, and record the incident in a register. It is better to prepare this plan before you need it.
What is a privacy incident?
According to the CAI, an incident is any access to personal information that is not authorized by law. Unauthorized use or disclosure, loss, and any other breach of its protection also count.
A few concrete examples:
- an email containing client files sent to the wrong person;
- a lost or stolen business laptop or phone;
- a hacked email account that gave access to identity documents or financial records.
What should you do as soon as you suspect an incident?
As soon as you have reason to believe an incident has occurred, the CAI states that you must take reasonable measures to reduce the risk of harm and to prevent similar incidents from happening again. In practice: change the affected passwords, cut off an access, recall a document sent by mistake.
How do you know whether the risk is “serious”?
The CAI indicates that you must assess the seriousness of the risk of harm by considering three elements:
- the sensitivity of the information involved;
- the foreseeable consequences of its use;
- the likelihood that it will be used for harmful purposes.
A list of clients with phone numbers does not carry the same weight as identity documents or financial information. If in doubt, write down your reasoning.
Who must you notify?
If the risk of serious harm exists, you must notify the CAI promptly, as well as the people concerned. Notice to the CAI is given in writing using the form “Avis à la Commission d’accès à l’information concernant un incident de confidentialité” available on the Commission’s website.
The notice to affected people must describe the information involved, the circumstances, the date or period, the measures taken and what the person can do to protect themselves. Exceptions exist: see the CAI page for details.
The incident register: mandatory, even without serious risk
Every business must keep a register of all privacy incidents, including those that do not present a risk of serious harm. According to the CAI, the register must be kept up to date, provided to the Commission on request and kept for at least five years after the business became aware of the incident. Its content and procedures are governed by the *Règlement sur les incidents de confidentialité* (Regulation respecting confidentiality incidents).
Where to start this week
- Name a person responsible for incidents (yourself, if you work alone).
- Create a simple register: date, what happened, information affected, risk assessed, measures taken, notices sent.
- Write a one-page procedure: who to call, who shuts off access, where the CAI form is.
- Turn on two-factor authentication for your email and main tools.
A register kept in a digital tool, with ready-to-fill templates, saves you from hunting for paperwork in the middle of a crisis. At Axentra Technologies, we build this kind of tracking to order, and automations from $499 + taxes; the 15-minute diagnostic is free.
This article is for information only and does not constitute legal advice.
