What to do next
Protect yourself before pursuing anyone
Place a fraud alert with both credit bureaus, change credentials and enable multi-factor authentication, and watch statements closely. Financial protection is time-sensitive in a way the legal claim is not.
Get the breach details in writing
What information was involved, when it occurred, when it was discovered, and what the organisation is offering. Keep the notification itself - it is the primary evidence of when you knew.
Complain to the right regulator
The Office of the Privacy Commissioner of Canada for federally regulated and most private-sector organisations; the Commission d'acces a l'information for Quebec under Law 25; the Information and Privacy Commissioner of Ontario for Ontario public bodies and health information. Complaints are free.
Document actual harm as it happens
Fraudulent transactions, time spent resolving them, credit impact and out-of-pocket costs. Canadian courts have been cautious about damages for breach alone, so documented consequences are what distinguishes a claim.
Check whether a class proceeding exists
Where many people were affected, a class action may be commenced. Watch for court-approved notices, and note that participating in one generally forfeits an individual claim on the same issue.
Frequently asked questions
Can I sue just because my data was exposed?
Canadian courts have generally required more than exposure alone - demonstrated harm or a recognised privacy tort. Documented financial loss or identity misuse materially strengthens a claim.
Is free credit monitoring enough?
It is useful and worth accepting, but accepting it does not release other claims unless you sign something that says so. Read what you are asked to agree to.
Who do I complain to?
The Privacy Commissioner of Canada, or the CAI in Quebec, or the IPC in Ontario depending on the organisation. All are free and can investigate and order remedies.
What kind of lawyer handles this?
A privacy or class actions lawyer. For an individual claim with modest documented loss, the regulator route and small claims are usually proportionate.
This is general information, not legal advice. Laws vary by location and every situation is different — speak with a qualified lawyer about your specific circumstances.