Law 25 Breach Notification: Reporting an Incident to the CAI

Monday, 8:40 a.m. The office manager at a dental clinic in Pointe-Claire notices dozens of auto-replies in her inbox. On Friday, she typed her password into a fake Microsoft sign-in page. Since then, someone has been reading her mail: appointment confirmations, treatment estimates, patient contact details.

The owner’s first question is almost always the same: “We have 72 hours to report this, right?” No. That is good news, as long as nobody treats it as permission to wait.

This guide follows the real order of an incident response: contain, assess, notify, record.

No 72-hour clock: what section 3.5 actually says

The 72-hour figure is everywhere, including on security vendors’ websites. It comes from Article 33 of Europe’s GDPR, not from Québec law.

Section 3.5 of the Act respecting the protection of personal information in the private sector sets two levels:

1. As soon as you have cause to believe an incident has occurred, you must take reasonable measures to reduce the risk of injury and prevent similar incidents. That applies to every incident.
2. If the incident presents a risk of serious injury, you must promptly notify the Commission d’accès à l’information (CAI) and the individuals whose information is involved.

“Promptly” does not mean “once the file is complete.” The CAI’s own guidance tells businesses to hurry. And the Regulation requires you to send the CAI, promptly, any information you learn after the initial notice (s. 4). In other words: report with what you know, then update.

If your business also falls under federal PIPEDA, for example because you operate in other provinces, the Office of the Privacy Commissioner of Canada expects reports “as soon as feasible” when a breach creates a real risk of significant harm. Two regimes, two tests. Map both with counsel before an incident, not during one.

Step 1: contain and preserve evidence

Before you even know whether you will have to report, act:

• Reset compromised passwords and revoke active sessions.
• Delete any forwarding or redirect rules the attacker created.
• Isolate suspicious machines from the network, without powering them off if you can: memory holds clues.
• Export audit logs before they age out.
• Write everything down with timestamps: who noticed what, which actions were taken, by whom.

Those notes will feed both the notice and the register. If you have no procedure yet, our incident response plan template is a solid starting point.

Step 2: assess the risk of serious injury

Section 3.7 requires you to consider, in particular, the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes. You must also consult your person in charge of the protection of personal information. The CAI suggests framing the analysis around six questions: who, how many, what, when, where and why.

Some typical scenarios, for illustration only:

Document your reasoning, especially when you conclude there is no serious risk. The register must record the factors that led you to that conclusion.

Step 3: complete the notice to the CAI

The notice must be in writing. The CAI provides an online form portal (formulaire.cai.gouv.qc.ca, under “Entreprise ou organisation privée”); the portal is in French, so prepare your answers in advance. Section 3 of the Regulation respecting confidentiality incidents sets the content. Gather these 11 items:

• Business name and, if applicable, Québec enterprise number (NEQ)
• Name and contact details of the person to reach about the incident
• Description of the personal information involved, or why you cannot describe it yet
• Brief description of the circumstances and, if known, the cause
• Date or period of the incident (or an approximation)
• Date or period when you became aware of it
• Number of people affected and, of those, Québec residents (or an approximation)
• Factors leading you to conclude there is a risk of serious injury
• Measures taken or planned to notify individuals, with dates or expected timing
• Measures taken or planned to reduce injury and prevent recurrence, with dates
• Where applicable, a statement that a privacy regulator outside Québec was also notified

You will not be alone: the CAI received 518 confidentiality incident notices between January 1 and December 10, 2025.

Step 4: notify affected individuals

The notice to individuals must contain six items (Regulation, s. 5): the information involved, a brief description of the circumstances, the date or period of the incident, the measures you took to reduce the risk, the measures you suggest they take, and contact details for a person or service who can answer questions.

Write it in plain language. For the Pointe-Claire clinic, useful advice would be: be wary of emails that mention details of your appointment, never send banking information by email, and call the clinic at its usual number if in doubt. Bilingual notices are worth considering if your clientele is mixed.

Notice is normally individual. A public notice (website, media) is allowed when individual notice could cause greater harm, would be excessively difficult, or when you lack contact details (Regulation, s. 6). You may also issue a public notice to act quickly, but individual notice is still required in that case.

Section 3.5 also lets you alert a person or body that could reduce the risk, such as a financial institution, sharing only the information needed. Your privacy officer must record that communication.

After the notice: register, follow-up and prevention

The incident is not closed because the form was submitted.

• Record it in your confidentiality incident register, including the dates notices were sent.
• Send the CAI any new information, such as a higher count of affected people or a confirmed cause.
• Fix the root cause: phishing-resistant MFA, blocking automatic forwarding to external addresses, targeted training.
• Hold a post-incident review with leadership in the following weeks.

This guide explains Law 25 obligations in plain terms and is not legal advice: validate every reporting decision with your legal counsel. To get ready before the next incident, our Law 25 compliance service can help you put the procedure and harm-assessment grid in place.