OPC launches new tool to assess if a privacy breach poses a real risk of significant harm

The Office of the Privacy Commissioner of Canada (OPC) has released today a tool that organizations can use if they have experienced a privacy breach to assess if the breach has created a real risk of significant harm to an individual (in which case they must report the privacy breach to the OPC). This tool provides a series of questions that the organization must answer and at the end of the process, it will indicate whether a real risk of significant harm is Likely or Unlikely. 

The tool will not ask for information that identifies the organization using it, nor will it send the information entered to the OPC. The OPC website states that the risk assessment results can be downloaded and that an organization submitting a privacy breach report to the OPC can include the results with its submission. The OPC further cautions that “The tool’s breach risk self-assessment result is only one element to consider in assessing a breach. The tool’s results do not replace your own judgment.”

This content has been updated on March 26, 2025 at 17 h 46 min.