WARNING - It is not legal advice — have counsel confirm the specific wording and workflow match your data practices.
Confidentiality Incident Response Process¶
Document owner: [Privacy Officer name/title] Effective date: [Month DD, YYYY] Last reviewed: [Month DD, YYYY]
Note before using: This process is built around Law 25’s requirements for “confidentiality incidents” (Quebec’s term for what other laws call a data breach). It is a starting template — adapt the roles, timelines, and thresholds to your organization’s size and risk profile, and have counsel review it. Replace all bracketed placeholders.
1. Purpose and scope¶
This process defines how [Company Name] detects, contains, assesses, and responds to any confidentiality incident — defined under the Act as the access, use, disclosure, loss, or any other unauthorized handling of personal information. It applies to incidents affecting information in any format: digital systems, paper records, or verbal disclosure, whether caused by us, an employee, or a third-party service provider.
2. Roles and responsibilities¶
| Role | Responsibility | Who |
|---|---|---|
| Privacy Officer | Owns the response, decides on notification, maintains the incident register | [Name/Title] |
| Incident lead / IT security | Technical containment, forensic investigation | [Name/Title] |
| Legal counsel | Advises on notification obligations, liability, contracts | [Name/Firm] |
| Communications | Drafts individual/public notifications if needed | [Name/Title] |
| Executive sponsor | Informed of high-severity incidents, approves resourcing | [Name/Title] |
| All employees | Report suspected incidents immediately | — |
How to report an incident internally: [email address / phone / ticketing system] — available [24/7 or business hours].
3. Process overview¶
1. DETECT & REPORT → 2. CONTAIN → 3. ASSESS → 4. NOTIFY → 5. DOCUMENT → 6. REVIEW
Step 1 — Detect and report¶
Anyone (employee, contractor, service provider, customer) who suspects a confidentiality incident must report it to the Privacy Officer immediately, using [reporting channel]. Do not wait to confirm — report on suspicion.
Capture at minimum: - What happened and how it was discovered - What information/systems are believed affected - When it occurred (or was discovered) - Who has been informed so far
Step 2 — Contain¶
Within [target: a few hours of report], the incident lead: - Stops ongoing exposure (e.g., disable compromised credentials, take a system offline, revoke access, retrieve misdirected mail/email) - Preserves evidence (logs, copies) before remediating, where possible - Identifies whether the incident is ongoing or contained
Step 3 — Assess¶
The Privacy Officer, with the incident lead and legal counsel, assesses:
a) What information was involved — categories, volume, sensitivity (e.g., name + email vs. financial/health/ID data)
b) Whether there is a risk of serious injury, considering the factors set out in the Act: - Sensitivity of the information - Anticipated consequences of its use (e.g., identity theft, financial loss, reputational harm) - The likelihood the information will be used for injurious purposes (e.g., was it encrypted, was it actually accessed vs. merely exposed, is there evidence of malicious intent)
c) Who is affected — number of individuals, whether any are minors or vulnerable persons
d) Root cause — internal error, malicious attack, third-party/vendor failure, physical loss, etc.
Document this assessment even if the conclusion is “no risk of serious injury” — the reasoning needs to be defensible.
Step 4 — Notify¶
If the incident presents a risk of serious injury, notify:
- The Commission d’accès à l’information (CAI) — using the CAI’s incident notification form, without delay
- Affected individuals — without delay, in clear language, including:
- Description of the incident
- Personal information involved
- Measures taken/planned to reduce harm
- Measures the individual can take to protect themselves
- Contact information for questions
- Any other organization or person who could help reduce the risk of injury (e.g., police, other affected organizations, payment processors), where doing so could mitigate harm
- Contractual counterparties — check vendor/client contracts for any additional notification obligations and deadlines
If the incident does not present a risk of serious injury, notification is not legally required, but must still be logged in the incident register (Step 5) with the reasoning.
Step 5 — Document¶
Every confidentiality incident, regardless of severity, is logged in the Confidentiality Incident Register, including:
| Field | Description |
|---|---|
| Incident ID | Sequential number |
| Date discovered / date occurred | |
| Description | What happened |
| Information involved | Categories and volume |
| Individuals affected | Number, categories (e.g., customers, employees) |
| Risk of serious injury assessment | Yes/No + reasoning |
| CAI notified? | Yes/No + date |
| Individuals notified? | Yes/No + date/method |
| Containment actions | |
| Root cause | |
| Corrective actions | |
| Closed by / date |
The register must be retained for at least 5 years and made available to the CAI upon request.
Step 6 — Review¶
Within [e.g., 2 weeks] of closing the incident: - Conduct a post-incident review with relevant stakeholders - Identify corrective/preventive actions (technical, policy, training) - Assign owners and deadlines for each action - Update this process if gaps were identified - If a vendor caused the incident, review/renegotiate the contract’s data protection clauses
4. Severity triage (for internal prioritization)¶
| Severity | Example | Target response time |
|---|---|---|
| Critical | Large-scale breach of sensitive data (health, financial, ID numbers), active exploitation | Contain within hours; assessment same day |
| High | Breach of moderate-sensitivity data affecting many individuals, or small-scale sensitive data breach | Contain within 24h; assessment within 48h |
| Medium | Limited exposure, low-sensitivity data (e.g., name/email only), small number of individuals | Contain within 2-3 days; assessment within a week |
| Low | Internal near-miss, no external exposure confirmed | Log and review at next scheduled review |
(Note: Law 25 doesn’t set a fixed notification deadline like GDPR’s 72 hours — the standard is “without delay” once risk of serious injury is confirmed. Don’t use this table to justify slow-walking a real risk; it’s for internal resourcing only.)
5. Vendor / third-party incidents¶
If a service provider or processor experiences an incident involving our customers’ data: - The vendor is contractually required to notify us [within X hours] of discovery — confirm this clause exists in your vendor agreements - We remain responsible for our own notification obligations to the CAI and affected individuals; the vendor’s notification to us does not discharge that - Track this in the same incident register
6. Training and testing¶
- All employees receive incident-reporting training at onboarding and [annually]
- The Privacy Officer runs a tabletop exercise [annually] simulating a confidentiality incident to test this process
- This document is reviewed at least [annually] or after any major incident
This process supports compliance with Quebec’s Act respecting the protection of personal information in the private sector (Law 25), including the confidentiality incident and register requirements. It is not legal advice — have counsel review before adoption.