On October 14 the Office of the Privacy Commissioner of Canada announced it has closed its investigation into WestJet, satisfied that the airline honoured a compliance letter it signed with the OPC in July. The 2025 breach involved an unauthorized actor accessing and extracting data affecting more than five million current and former customers and employees. The outcome is worth reading not because it is dramatic, but because it is specific: the measures the Commissioner accepted are effectively a published answer to the question every business asks after an incident, which is how much is enough.
The four things he accepted
Per the OPC, WestJet committed to and delivered:
- Reinforced multi-factor authentication requirements. Not introduced, reinforced. The gap in most organizations is not the absence of MFA but the exceptions to it.
- Strengthened identity and access controls. Who can reach what, and whether that is still appropriate.
- Improved overall security awareness. The people side, named as a deliverable rather than an afterthought.
- An external security firm engaged to assess whether the new measures actually work, with the results and any further recommendations shared with the OPC, plus an explanation of how WestJet would address them.
That fourth item is the one to sit with. Independent verification that the fix worked, reported back to the regulator. Almost no small business does that voluntarily, and it is the difference between saying you remediated and demonstrating it.
Strip out the airline
Look at that list again at small-business scale. Multi-factor authentication with no exceptions. A current picture of who can access what. Training that happens. Someone independent confirming it works. There is nothing in there that requires five million customers or an enterprise budget. It is the same short list we end up building with clients, now carrying the implicit endorsement of the federal regulator, which makes it a useful thing to point at when someone asks why these four and not something more sophisticated.
The quieter lesson: cooperate early
Commissioner Philippe Dufresne named his own takeaway, and it was not about technology. He pointed to early engagement between businesses and authorities on serious incidents, and described compliance letters as an important tool to address privacy issues quickly and efficiently.
Read that as a signal about how enforcement actually works in Canada. A compliance letter is a negotiated commitment: the organization agrees to specific improvements, does them, and the file closes. The alternative path, where an organization is slow, defensive or vague, is the one that generates findings and public reports. We saw the other face of this recently when the OPC opened an investigation into an ID-verification vendor and said it would examine the adequacy of its notifications, not just its safeguards. How you behave after a breach is being assessed as closely as how you prevented it.
What to actually do
- Audit your MFA exceptions. Find every account that skips it: service accounts, the owner's phone, the shared mailbox, the legacy app. Each one is the gap the word reinforced is pointing at.
- Produce a current access list. Who can reach your email, files, banking and client records today. If that takes more than an afternoon to assemble, that is itself the finding.
- Put awareness training on the calendar rather than in a policy. Two short sessions a year beats an annual document nobody opens.
- Get one independent look. You do not need a large firm. An outside review of your access, backups and exposure once a year is the cheapest credibility available, and it is what the regulator asked a five-million-customer company to do.
- Decide now how you would engage early. Know who you call, in what order, in the first hour. That is a plan question, and the answer shapes whether your file closes quietly.
The takeaway
Regulators rarely publish a checklist. This is about as close as it gets: four measures, one of them independent verification, accepted as sufficient for a breach touching five million people. If that is the bar for an airline, the version scaled to a twelve-person business is entirely affordable, and it is a far better conversation to have now than during an investigation.