One Incident, Potentially Multiple Breach Reporting Requirements – OSFI Introduces Cyber Breach Notification Guidelines for Financial Institutions

January 30, 2019 | David Krebs

On January 20, 2019, the Office of the Superintendent of Financial Institutions of Canada (OSFI) issued an Advisory (also read: OSFI’s Guidance on cyber incident management framework) regarding the responsibilities of federally regulated financial institutions (FRFI), including banks, federal credit unions, and loan and trust companies, to report Technology and Cyber incidents (effective date: March 31, 2019). The threshold for reporting is a “high” or “critical” severity level. The assessment is to be made by the institution itself.

Notification to the Lead Supervisor must be made within 72 hours (similar to the notification timelines under the European General Data Protection Regulation (GDPR) for incidents involving personal information). Since November 1, 2018, breaches involving personal information are reportable under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) but PIPEDA does not prescribe a precise notification timeline.

It is important to note that reportable cyber incidents under this OSFI Advisory go far beyond those breaches that involve or impact customer or personal information. The Advisory sets out examples of incident characteristics institutions should consider reportable:

  • Significant operational impact to key/critical information systems or data;
  • Material impact to FRFI operational or customer data, including confidentiality, integrity or availability of such data;
  • Significant operational impact to internal users that is material to customers or business operations;
  • Significant levels of system/service disruptions;
  • Extended disruptions to critical business systems/operations;
  • Number of external customers impacted is significant or growing;
  • Negative reputational impact is imminent (e.g., public/media disclosure);
  • Material impact to critical deadlines/obligations in financial market settlement or payment systems (e.g., Financial Market Infrastructure);
  • Significant impact to a third party deemed material to the FRFI;
  • Material consequences to other FRFIs or the Canadian financial system; and
  • A FRFI incident has been reported to the Office of the Privacy Commissioner or local/foreign regulatory authorities.

The institution must also notify the OSFI Technology Risk Division and the Lead Supervisor in writing as soon as possible, provide regular updates on the incident if and when new information emerges as well as on progress on remediation and mitigation. These reports must continue until the incident is contained and resolved.

When facing cyber/technology incidents there are now potentially a number of related but separate reporting and notification requirements for FRFIs to consider, in particular as they relate to incidents involving both personal information and other negative reputational, operational, financial or systems impact. That is, reporting may be required under PIPEDA, to the OSFI, neither, or both, potentially even under the GDPR, and using a different analysis as to why an incident requires a report or public notification.


This publication is provided as an information service and may include items reported from other sources. We do not warrant its accuracy. This information is not meant as legal opinion or advice.

Miller Thomson LLP uses your contact information to send you information electronically on legal topics, seminars, and firm events that may be of interest to you. If you have any questions about our information practices or obligations under Canada’s anti-spam laws, please contact us at

© Miller Thomson LLP. This publication may be reproduced and distributed in its entirety provided no alterations are made to the form or content. Any other form of reproduction or distribution requires the prior written consent of Miller Thomson LLP which may be requested by contacting