What Is Data Breach Notification?

Breach notification obligations determine what you must tell, to whom, and how quickly after personal data is compromised. For an organisation operating across jurisdictions the answer is rarely one obligation — it is several, with different thresholds, recipients and clocks running simultaneously.

The practical consequence is that notification is an operational capability rather than a legal one. The legal analysis is comparatively quick; establishing what was actually affected is what consumes the time.

The common shape, and where regimes differ

Almost every regime follows the same pattern: assess whether the breach meets a harm threshold, notify a regulator, notify affected individuals, and keep records. The differences are in the details that matter at 2am.

Thresholds vary in wording — real risk of significant harm, risk of serious injury, likely to result in a risk to rights and freedoms — and converge in practice. Recipients vary more: some regimes require a regulator and the individual, one requires a Minister as well, and health regimes may require a professional College. Clocks vary from a hard 72 hours to “without unreasonable delay”.

Build one process to the strictest standard

Running a separate process per regime is unworkable under pressure. The workable approach is a single assessment against the most demanding applicable threshold, followed by notification to everyone entitled under any of them.

Where the assessment is genuinely borderline, notify. Under-notification is the failure that generates enforcement and reputational damage; over-notification rarely does.

What actually delays organisations

Not the legal analysis. It is establishing scope — which records were accessed, by whom, over what period — which without adequate logging can take weeks while the clock runs. It is finding current contact details for affected individuals. It is deciding who signs off when nobody was designated in advance. And it is drafting under pressure with legal and communications reviewing in series.

Every one of those is fixable before an incident and nearly unfixable during one, which is the entire argument for preparing the process while nothing is wrong.

What the notification has to say

Content requirements converge across regimes on the same elements: what happened, in plain language and without minimising; what information was involved, specifically; what you have done to contain it; what the individual can do, concretely; and how to reach you, including their right to complain.

Two judgement calls recur. Credit monitoring is rarely a legal requirement and is close to an expectation where financial identifiers were exposed — declining to offer it becomes part of the story. And timing against an incomplete investigation is the harder one: most regimes require notification without unreasonable delay rather than waiting for certainty, so an honest first notification that states what is still unknown beats a complete one that arrives late.

Where to start

Write down, on one page, which regimes apply to you and who the decision-maker is under each. Most organisations have never done this, it takes an afternoon, and it is the first thing you will want when an incident starts.

See breach notification across Canada and the first 72 hours. GuardsArm supports incident response.