Most breach advice assumes the breach is yours. The more common experience for a small business is different: an email arrives saying a company you pay has had an incident, and your customers' information was in it. Your systems are fine. Your obligations may not be. This is how to work out what you actually owe, and to whom.
First, the uncomfortable principle
Under Canadian privacy law the organization that collected personal information remains accountable for it, including when it has been transferred to a third party for processing. PIPEDA Principle 4.1.3 puts it plainly, and Quebec's Law 25 takes a similar line. In practice this means a vendor's incident does not automatically become a vendor-only problem. If your client gave you their information and you put it in a system you chose, the question of whether anyone needs to be told is partly yours to answer.
That is not the same as saying every supplier incident triggers a notification from you. It means you cannot skip the assessment just because someone else caused it.
Step 1: find out what was actually lost
Vendor notifications are often vague on purpose, written by lawyers who do not yet know the scope. Push for specifics, in writing:
- Which of our records were involved, and which data fields. Names and emails is a different problem from dates of birth, government ID numbers or payment data.
- When did it happen, when was it discovered, and when did the unauthorized access stop.
- Was the data encrypted, and did the attacker also obtain the keys. Encryption only helps if it was actually effective.
- Has the data been published, offered for sale, or used. Exfiltration and exposure are not the same risk.
- Who else has been notified, including regulators, and under which law.
If a vendor will not answer these, that answer is itself information, both about this incident and about whether you keep them.
Step 2: assess real risk of significant harm, yourself
PIPEDA's trigger for notification is a breach of security safeguards creating a real risk of significant harm to an individual. Significant harm includes humiliation, damage to reputation or relationships, loss of employment or business opportunity, financial loss, identity theft, and negative effects on a credit record. Whether the risk is real depends mainly on two things: how sensitive the information is, and the probability it has been or will be misused.
Do this assessment on the data you collected, with your knowledge of who your customers are. The vendor cannot do it for you, because the vendor does not know what the records mean in your context. A list of email addresses is low sensitivity in general, and considerably less so if your business is a clinic and the list reveals who your patients are.
Write the assessment down even when the conclusion is that notification is not required. Which brings us to the obligation people forget.
Step 3: keep the record, regardless
PIPEDA requires organizations to maintain a record of every breach of security safeguards involving personal information under their control, whether or not it met the notification threshold, and to provide those records to the Privacy Commissioner on request. The retention expectation is 24 months. A breach register is a short document: date, what happened, what data, how many people, your harm assessment, what you decided and why, what you changed.
This is the single most commonly missed obligation in Canadian privacy compliance, and it is also the easiest to satisfy. A regulator who asks for your register and receives a competent two-page file forms a very different impression than one who receives nothing.
Step 4: if notification is required
Where there is a real risk of significant harm, PIPEDA requires you to notify both the Privacy Commissioner and the affected individuals as soon as feasible. The notification needs to be meaningful: what happened, what information was involved, what you and the vendor are doing about it, what the person can do to reduce their risk, and how to reach you. Quebec has its own reporting path to the Commission d'acces a l'information for organizations under Law 25, and sector rules may add more.
Two practical notes. First, coordinate with the vendor so your customers do not get two contradictory letters, but do not let the vendor's timeline become your excuse for delay. Second, how you notify is being judged as closely as whether you notify. Canada's privacy commissioner has opened investigations examining the adequacy of notifications, not just the safeguards that failed, which we covered when the OPC took on an ID-verification vendor.
Step 5: decide what changes
An incident at a supplier is the cheapest vendor review you will ever get, because you are finally motivated. Useful questions once the acute phase passes:
- Did we need to send them that data at all? Most breach exposure is data that was collected or shared out of habit.
- Does the contract actually require timely breach notice to us? If you learned about this from the news, it does not.
- How quickly can we get our data out and delete it if we leave? Test the answer before you need it.
- Is this vendor on a list somewhere, with an owner, or did we have to reconstruct what they held from memory?
What this means for your business
A supplier breach is not an event you can delegate to the supplier. The work is bounded though: get specifics in writing, assess the harm yourself against the data you collected, record the incident whether or not you notify, and notify properly if the threshold is met. Businesses that already know which vendors hold what can do all of this in a day. Businesses that do not spend the first week just finding out. The difference is a list and a habit, and both are things we help small businesses put in place before the email arrives.