Guest Data Breaches at Canadian Hotels and Restaurants: Which Rules Require a Report

What to take away

This is general information for Canadian operators, not legal advice, checked against the primary sources listed at the end in October 2026. Check the current statute text before relying on any summary.

Where guest data sits

An engagement program holds names, email addresses, mobile numbers, visit dates, preferences and sometimes payment details, spread across booking, reservation, email and texting tools. The software modules that make engagement efficient are also where a breach can start.

Editorial suggestion: before an incident, list every system holding guest contact data and who can log in. A hurried decision is only as good as that inventory.

Canada has no single answer on reporting. The Office of the Privacy Commissioner of Canada (OPC) explains that Alberta, British Columbia and Quebec have private-sector laws deemed substantially similar to PIPEDA, and that PIPEDA does not apply to organizations operating entirely within those provinces unless personal information crosses provincial or national borders.

British Columbia: a security duty without a reporting duty

In British Columbia, section 34 of PIPA (SBC 2003, chapter 63) requires an organization to protect personal information in its custody or under its control with reasonable security arrangements. Section 4(2) makes it responsible for information under its control even if that information is not in its custody, so a guest list uploaded to an outside email platform stays your responsibility.

The Act, as published by BC Laws and shown as current to 20 October 2026, contains no section requiring notice of a breach to the Commissioner or to the individuals affected. The Office of the Information and Privacy Commissioner for BC (OIPC) confirms this on its breach webform page: reporting is recommended, the Commissioner wants PIPA amended to make it mandatory, and until then the office strongly recommends reporting as a best practice.

A breach is not consequence-free in British Columbia. The OIPC may investigate whether a response complied with PIPA, and:

The OIPC's quick reference guide for small and medium-sized businesses gives four steps: containment, risk assessment, notification and reporting, and prevention. It says reporting to the OIPC where there is a significant risk of harm shows due diligence. It also says to notify the police if the breach involves theft or other criminal activity, and to document the risk assessment.

Editorial suggestion: treat the OIPC recommendation as your working rule. Any summary that cites a breach reporting section of BC PIPA should be checked against the Act, because the published text has none.

Alberta: notice to the Commissioner is mandatory

Under section 34.1(1) of Alberta's PIPA (SA 2003, chapter P-6.5), an organization having personal information under its control must, without unreasonable delay, give notice to the Commissioner of any incident involving loss of, or unauthorized access to or disclosure of, that information where a reasonable person would consider there is a real risk of significant harm to an individual. The notice must include what the regulations prescribe.

Section 37.1 lets the Commissioner require the organization to notify the individuals at risk within a period the Commissioner sets. Section 59(1)(e.1) makes failure to notify the Commissioner an offence, with a fine of up to $100,000 for an organization under section 59(2). Those figures come from the King's Printer consolidation current as of 1 September 2025, so confirm them before quoting.

Federal PIPEDA: report, notify and record

PIPEDA matters to hospitality in two ways. The OPC says it generally applies to private organizations in Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, Saskatchewan and the territories. It also says organizations handling personal information that crosses provincial or national borders are subject to it. Editorial suggestion: whether a particular vendor setup triggers that second case is a legal question, so ask counsel once and record the answer.

Where PIPEDA applies, the breach rules sit in sections 10.1 to 10.3:

The Breach of Security Safeguards Regulations (SOR/2018-64) require a written report covering the circumstances, dates, information involved, number of people affected, steps taken and a contact person, and records kept for 24 months. The OPC adds that the rules apply to organizations of all sizes and that the number of people affected does not decide whether to report.

Quebec: serious injury and a register

In Quebec, a confidentiality incident that presents a "risk of serious injury" leads to notices under section 3.5 of the Act respecting the protection of personal information in the private sector. The Regulation respecting confidentiality incidents (Gazette officielle du Québec, 14 December 2022) sets what a notice to the Commission d'accès à l'information must contain, including the elements that led the business to conclude there is a risk of serious injury: sensitivity, possible ill-intentioned uses, anticipated consequences and likelihood of injurious use. The people concerned receive their own notice.

The Regulation also fixes the register's contents, including the reasons for concluding whether or not there was a risk, and requires the information to be kept at least five years after the business became aware of the incident. Quebec consent and French-language rules sit elsewhere; see the comparison of Canadian and US guest engagement rules.

Deciding whether the harm test is met

The OPC reduces the federal test to two questions: how sensitive is the information, and how likely is misuse? It suggests asking who accessed the data, whether there is evidence of malicious intent and whether the data was encrypted. The OIPC guide asks for the type and volume of information, the potential for fraud or harmful use, the cause and extent of the breach, and whether records were password protected or encrypted.

Editorial suggestion: sort guest data in advance.

Treat a list that mixes the first two groups as the higher level, and write down the reasoning for every incident, including those you decide not to report.

Vendors in the chain

Your position does not change when the vendor is the one hacked. In British Columbia, PIPA section 4(2) keeps you responsible. Under PIPEDA, clause 4.1.3 of Schedule 1 says an organization remains responsible for information it gives a third party to process and must use contracts or other means to get comparable protection.

Editorial suggestion: before signing with an engagement vendor, get four answers in writing.

Our review of hotel upsell software for Canadian properties covers the same ground from a buying angle. Treat the incident-notice clause as a deal-breaker, not a detail.

A response log you can start today

The Canadian Centre for Cyber Security's baseline controls for small and medium organizations begin with a written incident response plan that names who handles incidents and their contacts, including regulators, and is available in hard copy.

Use the federal regulation's fields as a starting template and add the Quebec register items, such as when you became aware of the incident and the reasons for your risk conclusion. For each incident record:

Editorial suggestion: keep every log for five years, the Quebec minimum, so the group runs one procedure. When guests must be told, the federal regulations say the notice covers the circumstances, the date, the information involved, what you have done, what the guest can do and who to contact. Send it as a plain service message, kept apart from promotions, as explained in the guest messaging setup guide.

Common questions

Sources