The Office of the Privacy Commissioner of Canada announced on October 26 that Loblaw has signed a compliance letter, dated October 21, committing to additional measures under federal private-sector privacy law after a breach affecting roughly two million Canadians. One term in it is worth more attention than the rest: by October 31, 2027, Loblaw must provide the Commissioner with a confidential security assessment prepared by an independent external firm approved by the OPC.
Two cases make a pattern
Eleven days ago we wrote about the OPC closing its WestJet investigation, and noted that the unusual item on the list was independent verification that the fixes actually worked, reported back to the regulator. Here it is again, and sharper: not just an external assessment, but one from a firm the Commissioner has approved, delivered by a fixed date a year out.
Two cases is enough to plan around. The emerging shape of a negotiated resolution in Canada looks like this: commit to specific improvements, then pay someone independent to confirm you made them, and let the regulator see the result. For a small business the relevant question is not whether you will ever sign a compliance letter. It is that the regulator has now twice told you what it considers adequate proof, and self-assessment is not on the list.
The timing detail nobody is discussing
Loblaw became aware of unauthorized activity in its systems around early March 2026 and contained it that month with help from a third-party cybersecurity firm. It posted a public notice on its website and in the PC Optimum app. Direct notification of affected individuals began in late October, roughly seven months later.
Set aside whether that was reasonable for an organization of that size, because the point for a smaller business is different. The OPC has been explicit this autumn that it examines the adequacy of notification as a separate question from the security failure, which it said directly when it opened an investigation into an ID-verification vendor in September. A posted notice and a direct notification are not the same thing, and the gap between containment and telling people is now something a regulator looks at on its own.
To be fair on the facts: Loblaw says passwords, health information and credit card data were not compromised, and that PC Financial was not affected. Customers were logged out of apps linked to their PCiD as a precaution.
What to actually do
- Assume an independent look is the standard. You do not need a large firm. An outside review of your access, backups and exposure once a year is now the thing a regulator treats as evidence, and it is cheap compared with establishing credibility during an investigation.
- Separate your two notification questions in advance: what you post publicly, and how you reach affected individuals directly. Decide now which contact details you actually hold well enough to use.
- Write the containment-to-notification clock into your plan. If your incident response plan ends at containment, it stops before the part being scrutinized.
- Keep the breach record regardless. PIPEDA requires a register of every breach of security safeguards whether or not it met the notification threshold, retained 24 months and producible on request. Still the most commonly missed obligation in Canadian privacy compliance.
- Read a compliance letter once. The Loblaw and WestJet letters are public and short. They are the clearest statement available of what the regulator asks for after a breach.
The takeaway
Regulators rarely publish requirements in advance. What they do publish is what they accepted from someone else, and twice this month that has included an independent assessment with a named approver and a date. A small business cannot reproduce Loblaw's programme, but it can book one external review a year and know how it would reach its customers directly. Both are affordable, and both are now on the record as what adequate looks like.