What Actually Happens After a Data Breach — The Financial and Legal Reality for Ontario Businesses

Most business owners think of a data breach as a technical problem — something your IT team fixes and then you move on. The reality is far more complicated, more expensive, and more legally consequential than most people expect.

If your business collects personal information from clients, employees, or patients — and in Ontario, virtually every business does — a breach triggers a cascade of legal obligations, financial costs, and operational disruptions that can last months or years.

Here is what actually happens after a data breach in Ontario, and why preparation is worth far more than response.

The Immediate Reality: PIPEDA and Mandatory Breach Reporting

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations collect, use, and disclose personal information. Since November 2018, PIPEDA has included mandatory breach reporting requirements under section 10.1 of the Act, added by the Digital Privacy Act amendments.

If your business experiences a breach of security safeguards involving personal information, and it is reasonable to believe the breach creates a real risk of significant harm (RROSH) to an individual, the Act requires you to:

1. Report the breach to the Office of the Privacy Commissioner of Canada (OPC)
2. Notify the affected individuals whose personal information was involved
3. Notify any other organizations that may be able to reduce the risk of harm

There is no explicit 72-hour deadline in PIPEDA the way there is under the EU’s GDPR, but the statute requires the report and the notifications to be made as soon as feasible after the organization determines that a breach has occurred, and the OPC’s breach guidance reads that the same way. In practice, that means days, not weeks. Delaying notification when you know there is a risk of harm compounds your legal exposure.

What Counts as “Real Risk of Significant Harm”?

The standard is broad. Under section 10.1(7), significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property. If the breach involves sensitive information — health records, financial data, government-issued IDs — the threshold is likely to be met.

You must also keep records of every breach of security safeguards, whether or not it meets the RROSH threshold. The Breach of Security Safeguards Regulations set the retention period at 24 months from the day you determine the breach occurred, and the OPC can request those records.

The Financial Cost: What the Numbers Actually Say

The financial impact of a data breach goes far beyond the cost of fixing the technical problem. IBM’s 2024 Cost of a Data Breach Report puts the average cost of a data breach for Canadian organizations at CA$6.32 million. IBM’s methodology groups the cost into four categories:

• Detection and escalation costs — forensic investigation, assessment, audit services, crisis management
• Notification costs — contacting affected individuals, setting up call centres, credit monitoring services
• Post-breach response costs — legal fees, regulatory fines, identity protection services, customer service
• Lost business costs — customer churn, reputation damage, increased customer acquisition costs, revenue loss during downtime

For small and mid-sized businesses, the total may be lower in absolute terms — but as a percentage of revenue, it can be devastating. The Canadian Federation of Independent Business (CFIB) reported in a December 2022 survey that 45% of small businesses had experienced a random cyberattack in the prior year, and 27% a targeted one. Figures circulating at the time this post was first published (April 2026) put the cost above $100,000 for one in five small businesses hit by an incident; we have not been able to trace that figure to a primary CFIB publication, so treat it as reported rather than confirmed.

The Hidden Costs Nobody Warns You About

Beyond the headline numbers, there are costs that do not show up in breach reports:

• Cyber insurance premium increases — after a claim, expect your premium and your underwriting scrutiny to rise at renewal; the size of the increase depends on the carrier, the claim and the market at the time
• Management distraction — breach response consumes executive time for months
• Employee morale and turnover — staff lose confidence in the organization
• Vendor and partner scrutiny — your business partners will reassess their relationship with you
• Ongoing monitoring costs — you may need enhanced security monitoring for years after the breach

Legal Exposure and Class Action Risk

Canada has seen a significant increase in class action lawsuits following data breaches. The Court of Appeal for Ontario’s 2012 decision in Jones v. Tsige recognized the tort of intrusion upon seclusion in Ontario, and subsequent cases have expanded the legal landscape.

Notable Canadian breach-related class actions include:

• Desjardins Group (2019): A breach affecting roughly 9.7 million individuals led to a class action settlement of nearly $200.9 million, approved by the Superior Court of Quebec in June 2022 — the largest to date in the Canadian financial services sector
• LifeLabs (2019): A breach exposing the personal information of up to 15 million customers led to a class action that settled for between $4.9 million and $9.8 million; with more than 900,000 valid claims, each claimant received $7.86 in May 2024
• Capital One Canada (2019): Part of the broader Capital One breach affecting roughly 6 million Canadians; the certified Canadian class action settled for $35 million in July 2026, subject to a BC Supreme Court approval hearing on 22 September 2026

Even if a class action does not succeed, the legal costs of defending one are substantial. Defence costs in Canadian privacy class actions have been reported in the high six figures to low seven figures before any settlement; the number depends heavily on how far the case proceeds.

For small businesses, the risk may be less about class actions and more about OPC complaints and investigations. Individual complaints to the OPC can trigger investigations, and the Commissioner can publish findings that name your organization — creating permanent, searchable public records of your breach.

The Cyber Insurance Claims Process

If you have cyber insurance — and you should — filing a claim after a breach is not as straightforward as calling your broker.

Most cyber insurance policies require you to:

1. Notify your insurer promptly — many policies set a notification window; read yours so you know whether it is measured in hours or days
2. Use the insurer’s approved vendors — your policy likely requires you to use their pre-approved forensic investigators, breach coaches, and legal counsel
3. Document everything — every action taken, every cost incurred, every communication sent
4. Cooperate fully — withholding information or failing to follow the insurer’s process can void your coverage

The Insurance Bureau of Canada reports that Canadian cyber insurers’ combined loss ratios averaged roughly 155% between 2019 and 2023 — insurers were paying out far more than they collected — which is why underwriting questions and control requirements tightened so sharply.

Common reasons claims are denied or reduced:

• Failure to maintain minimum security controls — if your policy requires MFA and you did not have it enabled, your claim may be denied
• Late notification — missing the reporting window
• Pre-existing vulnerabilities — if the breach exploited a known, unpatched vulnerability
• Social engineering exclusions — some policies exclude losses from phishing or business email compromise unless you have specific endorsements

This is why maintaining strong security controls is not just good practice — it is often a condition of your insurance coverage. Our cybersecurity checklist covers the controls most cyber insurance underwriters ask about.

Reputational Damage: The Cost That Compounds

IBM’s 2024 report found that lost business and post-breach response costs were among the largest contributors to the record global average of US$4.88 million per breach — and for small businesses where client relationships are personal, the impact is even more pronounced.

For businesses in smaller communities, reputation damage hits differently than it does for a faceless national brand. Your clients know you. They refer you to their colleagues. They trust you with their sensitive information precisely because you are local and accountable. A breach does not just damage your brand — it damages personal relationships that took years to build.

The reputational cost is also asymmetric. A breach makes headlines. The recovery does not. You may do everything right after the incident — respond quickly, notify everyone, improve your security — and still find that the breach is the first thing that comes up when someone searches your business name.

What You Should Be Doing Now

The best time to prepare for a breach is before it happens. Here is where to focus:

1. Know Your Obligations

Understand what personal information you collect, where it is stored, and what your PIPEDA obligations are. If you handle health information, you may also have obligations under Ontario’s Personal Health Information Protection Act (PHIPA) — and since January 1, 2024, the Information and Privacy Commissioner of Ontario has had the discretion to issue administrative monetary penalties of up to $50,000 for individuals and $500,000 for organizations, with the penalty factors including whether the person could have taken steps to prevent the contravention. Documented staff training is now an underwriting and compliance control, not a “nice to have.”

2. Implement Preventive Controls

Many breaches are preventable with basic security hygiene. Multi-factor authentication, endpoint protection, email security, regular patching, and network security monitoring stop a large share of attacks before they succeed — the Canadian Centre for Cyber Security’s baseline controls for small and medium organizations is a good checklist.

3. Get Cyber Insurance — and Understand Your Policy

Do not wait until after a breach to read your policy. Understand what is covered, what is excluded, and what security controls you are required to maintain.

4. Build an Incident Response Plan

Know who does what when something goes wrong. Have your contacts, your procedures, and your communication templates ready before you need them. Our Business Continuity Planner can help you build that foundation.

5. Test and Update Regularly

Run tabletop exercises. Review your security controls. Update your incident response plan. Verify your backups. Security is not a one-time project — it is an ongoing process.

The Bottom Line

A data breach is not just an IT problem. It is a legal event, a financial event, and a reputational event — all at once. The businesses that survive breaches with the least damage are the ones that prepared for them before they happened.

If you are not sure where your business stands, a free assessment is a practical starting point. We will look at your current security posture, identify gaps, and help you understand your risk — before a breach forces you to learn the hard way.

Sources and last verified

Last verified 11 September 2026. The IBM cost figures are refreshed annually, the Capital One settlement was still awaiting court approval at verification, and insurer notification windows and control requirements change with each policy form.

• PIPEDA, sections 10.1–10.3, Government of Canada (Justice Laws): mandatory breach reporting, notification “as soon as feasible”, the definition of significant harm, and record-keeping.
• Breach of Security Safeguards Regulations (SOR/2018-64), Government of Canada: 24-month breach record retention.
• What you need to know about mandatory reporting of breaches of security safeguards, Office of the Privacy Commissioner of Canada: the OPC’s reading of the reporting and notification obligations.
• IBM Report: Escalating Data Breach Disruption Pushes Cybersecurity Costs in Canada, IBM Canada (30 July 2024): the CA$6.32 million Canadian average.
• Surging data breach disruption drives costs to record highs, IBM: the US$4.88 million global average and lost-business cost drivers.
• Nearly half of small businesses have experienced random cyberattacks in the past year, CFIB (8 December 2022): the 45% and 27% figures.
• Jones v. Tsige, 2012 ONCA 32, Court of Appeal for Ontario: recognition of intrusion upon seclusion.
• Quebec court approves $200.9M settlement against Desjardins over data breach, CBC News (June 2022): the Desjardins settlement.
• Claimants in LifeLabs data-breach class action to get $7.86 each, CBC News (May 2024): the LifeLabs settlement range and payout.
• Capital One 2019 Data Breach Class Action, class counsel via Cision (16 July 2026): the $35 million Canadian settlement and approval hearing date.
• Canada’s cyber insurance market finds its footing, Insurance Bureau of Canada: the 155% combined loss ratio for 2019–2023.
• Administrative monetary penalties under PHIPA (notice), Information and Privacy Commissioner of Ontario: the 1 January 2024 start date and the $50,000 / $500,000 maximums.
• Personal Health Information Protection Act, 2004, Government of Ontario: PHIPA.
• Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security: the preventive-controls checklist.