Does PIPEDA require security awareness training?

PIPEDA's privacy principles are set out in Schedule 1 of the Act. Principle 4.7, Safeguards, says personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

Clause 4.7.3 lists the methods of protection: physical measures, organizational measures and technological measures. Clause 4.7.4 is the one that matters for training. It says organizations "shall make their employees aware of the importance of maintaining the confidentiality of personal information."

The word "shall" makes this an obligation, not a suggestion. The Act does not say how often, how long or in what format, which leaves each organization to choose an approach that fits the sensitivity of the information it holds.

The Office of the Privacy Commissioner of Canada (OPC) publishes guidance on how to meet the Safeguards principle. It tells organizations to develop and implement a security policy, make employees aware of the importance of security and confidentiality, and hold regular staff training on security safeguards.

The OPC also notes that PIPEDA does not prescribe specific safeguards. Organizations are expected to review their protections regularly and keep them current as technology and threats change. Phishing is one of those changing threats, so training that only happened once, years ago, is hard to defend.

Since November 2018, PIPEDA has required organizations to report breaches of security safeguards to the OPC when it is reasonable to believe the breach creates a real risk of significant harm to an individual. Affected individuals must also be notified as soon as feasible in those cases.

Organizations must also keep a record of every breach of security safeguards, whether or not it meets the harm threshold. The OPC says these records should be kept for at least 24 months after the day the organization determines the breach occurred.

Many breaches start with a phishing email that leads to a stolen password. A trained employee who reports a suspicious message quickly can stop an incident before it becomes a reportable breach. If a breach does happen, records showing staff were trained help the organization explain what safeguards were in place.

Alberta, British Columbia and Quebec have their own private sector privacy laws that the federal government has deemed substantially similar to PIPEDA. In those provinces, the provincial law generally applies to personal information handled within the province.

PIPEDA still applies in those provinces to personal information that crosses provincial or national borders, and to federally regulated businesses such as banks, telecommunications companies and transportation companies. A small business in one of these provinces should check which law applies to it, and confirm the specific safeguard and breach rules with a privacy lawyer or the provincial commissioner.

Because PIPEDA is principle based, the test is whether your safeguards are appropriate to the information you hold. A dental office or accounting firm holding health or financial details should expect a higher bar than a business that only keeps names and email addresses.

For most small businesses, a reasonable program is short, regular and documented. It covers the threats staff actually see, which today means phishing, fake invoices and requests to change payment details.

Many small businesses rely on their managed service provider for security. An MSP can run the training program, track completion and hand the client a report it can keep with its privacy records or share with an insurer.

NetMinder is a phishing simulation and awareness training platform that MSPs run for their clients under their own brand. It sends monthly practice phishing emails, shows a short lesson when someone clicks, and produces completion certificates and a training report for any date range. Those records can help a business document its training. They do not on their own make a business compliant with PIPEDA.