What breach records does PIPEDA ask a business to keep?

Which breaches must be recorded?

The duty covers every breach of security safeguards involving personal information the organization controls, including a breach that did not have to be reported. Section 10.3 has no harm test of its own.

An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.

How long is a record kept?

The regulations say a record is kept for 24 months after the day the organization determines that the breach occurred.

For the purposes of subsection 10.3(1) of the Act, an organization must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred.

What goes in the record?

The regulations say the record must hold enough information for the Commissioner to check whether the organization met its duties to report and to notify individuals.

The record referred to in subsection 10.3(1) of the Act must contain any information that enables the Commissioner to verify compliance with subsections 10.1(1) and (3) of the Act.

Who can ask to see it?

The Privacy Commissioner. On request, the organization gives the Commissioner access to a record or a copy of it.

An organization shall, on request, provide the Commissioner with access to, or a copy of, a record.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.