We use analytics cookies to understand how the site is used and improve it. No tracking runs until you allow it. See our Privacy Policy.
When personal information leaks, by hack, lost laptop or misdirected email, this pays for the response and the claims.
Get a quoteIn short
Privacy breach coverage pays the costs and claims that follow when personal information your business controls is lost, stolen or disclosed without authority, whether by a hacker, a lost laptop, a misdirected email or a stolen box of files. It funds breach counsel, investigation, notification, credit monitoring and call centres, defends regulatory investigations, and pays damages and defence when affected people sue.
Last reviewed
Privacy breach coverage pays for what follows when personal information you control is lost, stolen or disclosed without authority: breach counsel, notification, credit monitoring and call centres, defence in a privacy commissioner's investigation, and claims from the people affected. It responds to paper files and lost devices as well as hacks. Ransomware, downtime and payment fraud belong in a full cyber insurance program.
Under PIPEDA, a breach creating a real risk of significant harm must be reported to the federal Privacy Commissioner and to the people affected, and every breach must be recorded for 24 months. Alberta and Ontario's health sector add their own rules. We size the response limit to the data you really hold, so a breach of thousands of records doesn't meet a sublimit built for hundreds.
Privacy breach cover is built around personal information, not computers. The trigger is the loss of, or unauthorized access to or disclosure of, information about identifiable people, in any format. It usually has two halves.
It does not cover ransom demands, rebuilding systems, network downtime or stolen funds. Those belong in a full cyber insurance program, which often includes privacy breach as one insuring agreement. Claims that your published content invaded someone's privacy are usually handled under media liability.
Every business that collects personal information in the course of commercial activity carries breach duties, and the costs scale with the number of people affected and the sensitivity of what you hold. The federal Privacy Commissioner's 2025-26 annual report counted almost 700 breach reports from businesses, affecting more than 20 million Canadians.
Privacy breach cover is almost always written on a claims-made basis, often inside a cyber policy and sometimes as a smaller endorsement on a package. The details that decide a claim:
Outside Alberta, British Columbia and Quebec, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) generally governs personal information collected in the course of commercial activity. Since its breach provisions came into force, four duties apply to the organization that controls the information, even if a vendor was holding it.
| Duty | When it applies | What is required |
|---|---|---|
| Report to the Privacy Commissioner | A breach of security safeguards the organization reasonably believes creates a real risk of significant harm | A written report as soon as feasible: circumstances and cause, date or period, the information involved, number of people affected, steps taken to reduce harm and to notify, and a contact person |
| Notify affected individuals | Same real risk of significant harm threshold, unless another law prohibits it | A conspicuous notice, usually direct, as soon as feasible, explaining what happened, what was involved, what you have done and what they can do. Indirect notice is allowed only in prescribed cases, such as when you have no contact details |
| Notify other organizations | When another organization or government institution may be able to reduce the harm | Notice as soon as feasible, for example to a bank or credit bureau |
| Keep a breach record | Every breach of security safeguards, whether or not it meets the threshold | A record kept for 24 months after you determine the breach occurred, with enough detail for the Commissioner to verify compliance, provided on request |
Significant harm is defined broadly. It includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on a credit record and damage to property. The assessment weighs the sensitivity of the information and the probability it will be misused. That judgement is where breach counsel paid by the policy earns its fee.
Record-keeping is the duty businesses most often miss. A lost USB key that you decide is low risk still needs an entry in the breach log, and the Commissioner can ask to see it.
Alberta and British Columbia have their own private-sector privacy laws, and Ontario adds a separate regime for health information. Quebec has its own law, which we don't address because we don't place business in Quebec.
| Jurisdiction and law | Who it applies to | Breach duty |
|---|---|---|
| Alberta: Personal Information Protection Act (PIPA) | Private-sector organizations in Alberta | Notify the Information and Privacy Commissioner in writing, without unreasonable delay, where a reasonable person would consider there is a real risk of significant harm. The Commissioner can require you to notify affected individuals. Failing to notify is an offence, with fines up to $100,000 for an organization |
| British Columbia: Personal Information Protection Act (PIPA) | Private-sector organizations in BC | Breach reporting has been voluntary under BC PIPA, and the BC Commissioner has called for a mandatory rule. Check current status with us before relying on this; notifying affected people is still often prudent |
| Ontario: Personal Health Information Protection Act, 2004 (PHIPA) | Health information custodians, such as physicians, clinics and other regulated providers | Notify the individual at the first reasonable opportunity if personal health information is stolen, lost or used or disclosed without authority, telling them they can complain to the Commissioner. Notify the Information and Privacy Commissioner of Ontario where prescribed circumstances apply |
A business with customers or staff in several provinces can face more than one regime for the same incident. A good policy pays breach counsel to work through all of them, not just the federal one. Health practitioners can see how this fits their wider program in our malpractice guide.
A reported breach can lead to questions from the regulator. Under PIPEDA, knowingly failing to report, notify or keep breach records, or obstructing the Commissioner, is an offence punishable by a fine of up to $10,000 on summary conviction or $100,000 on indictment. In Alberta, failing to notify the Commissioner can be investigated as an offence, with fines up to $10,000 for an individual and $100,000 for an organization. Even where no fine follows, responding to an investigation takes legal time, and the regulatory proceedings cover pays for it.
Civil claims are the other half. In Owsianik v. Equifax Canada (2022), the Court of Appeal for Ontario held that intrusion upon seclusion is not available against an organization whose database was hacked by a third party, because the tort requires the defendant itself to invade privacy. That narrowed one route for class actions, but plaintiffs can still sue in negligence or breach of contract, which generally require proof of financial loss. Defence costs in a certified or contested class action can be large even when damages are modest, which is why the liability limit matters.
| Excluded or limited | How to cover it |
|---|---|
| Ransomware, extortion and system restoration | A full cyber policy |
| Lost income while systems are down | Cyber business interruption |
| Money stolen by fraud or an employee | Commercial crime, with social engineering where needed |
| Intentional or criminal acts by owners or senior officers | Not insurable; innocent co-insured wording can protect the business itself |
| Collecting or using data without consent, as a business practice | Usually excluded; fix the practice, and check D&O for management decisions |
| Breaches known or reported before the policy started | Disclose on the application; consider prior acts cover when changing insurers |
| Notification beyond the sublimit or headcount cap | Size the response limit to the largest dataset you hold |
| Errors in professional advice unrelated to data security | Professional liability |
The two are often confused because they are often sold together. The difference is the loss they follow.
| Privacy breach coverage | Full cyber program | |
|---|---|---|
| What triggers it | Exposure of personal information, in any format | A cyber incident affecting your systems or data, whether or not personal information is involved |
| Paper records and lost devices | Usually covered | Covered only if the cyber form includes privacy breach |
| Ransomware and extortion | Not covered | Covered |
| Network downtime | Not covered | Covered after a waiting period |
| Funds transfer fraud | Not covered | Often covered to a sublimit |
| Usually fits | Firms with sensitive files but simple systems, or as a package endorsement | Any business that depends on its network or moves money electronically |
A hypothetical bookkeeping firm in Saskatoon has an unencrypted laptop stolen from an employee's car. It holds client tax files with names, SINs and banking details for about 1,200 people.
No hacking was involved and the firm had no downtime, so a privacy breach policy handled the whole event. Full-disk encryption would likely have changed the harm assessment entirely, which is why insurers ask about it.
Premiums depend on how much personal information you hold and how well it is protected. Underwriters look at:
Because privacy breach is usually rated within cyber, it moves with that market. Marsh's Global Insurance Market Index put Canadian cyber rates down 5% in the third quarter of 2026. Small firms can sometimes add a privacy endorsement to a small business package, but the sublimit should be tested against your real headcount.
Insurabiz is an independent brokerage working only in business insurance. Our job is to size the response limit to the data you really hold and fit it with your other policies.
Our claims team coordinates with breach counsel and the insurer from first call to close.
Good to know
Sources
This page is general information, not insurance or legal advice. Coverage depends on your policy wording and the insurer. Speak with a licensed broker about your situation.
Insurer partners
We shop these partners to find the right coverage and price for you.
Privacy Breach Coverage
Compare 17 insurers, no obligation
Speak with an advisor
A fast, no-obligation quote from Canada's commercial insurance specialists. Real advice, the whole market compared, and someone who picks up the phone.