A Company Lost Your Data: What to Do After a Data Breach

Under PIPEDA, a business must notify you if a breach of security safeguards involving your personal information creates a real risk of significant harm.

Right away

1. Change passwords for the affected account and any account using the same password.
2. Turn on two-factor authentication.
3. Watch bank and credit card statements.
4. Check your credit reports with Equifax and TransUnion, and consider a fraud alert.

Beware of follow-up scams

Criminals often use breach news to send fake emails or calls. Don't click links or give information; contact the company directly using a number you trust.

What the business should do

• Notify affected people and the Privacy Commissioner when there is a real risk of significant harm.
• Explain what happened and what it is doing.
• Often, offer credit monitoring.

Your options

• Complain to the Office of the Privacy Commissioner of Canada.
• Class actions are sometimes started after large breaches; you may be included automatically.
• Individual claims are possible where you suffered real losses.

Keep records

Save the notice, and records of any losses or time spent fixing problems.

Sources

• Personal Information Protection and Electronic Documents Act
• OPC: what to do after a privacy breach
• Lost wallet or identity theft (NEO guide)

Read next: Unconscionable Contracts: When a Deal Is Too Unfair to Enforce

General Ontario legal information, not legal advice for your matter, and reading it does not create a retainer. Sources checked 16 October 2026: check the current law, forms and dates before you act.

Photos from Unsplash: a laptop computer sitting on top of a desk · black-framed eyeglasses on white printing paper.

This article is general information for people in Ontario, not legal advice. Rules, forms and deadlines change, and every situation is different. Check the current rule or speak to a licensed legal professional before you act.