What to do after a data breach in Canada: a calm checklist

A breach notice is unsettling, but most of what you need to do takes about twenty minutes, and some of it you only need to do once. This is the order we’d do it in.

First, understand what the notice is telling you

Under Canada’s federal private-sector privacy law, PIPEDA, an organization that has a breach must report it to the Privacy Commissioner and notify you when it creates a “real risk of significant harm.” A notice means the company has decided that bar was met for you. It should say what was exposed. That list decides what you do next:

• Email address only: expect more phishing. Nothing else to do.
• Password (even “encrypted”): change it, and change it anywhere else you reused it.
• Phone number: expect scam texts and calls; be wary of anyone who “already knows” you.
• Birth date, address or government ID: these are what someone needs to open accounts in your name. Protect your credit file (step 4).
• Card number: call your card issuer. They’ll usually replace the card.

If the notice is vague, you can ask the company for details. Under PIPEDA you have a right to access the personal information an organization holds about you, and it generally has to answer within 30 days.

The checklist

1. Don’t click links in the notice or in follow-ups. Real or not, go to the company’s site or app yourself. Breach notices are a favourite template for phishing.
2. Change the password for that account, and for any account where you reused it. A password manager makes every password unique, which turns the next breach into a one-account problem.
3. Turn on stronger sign-in. A passkey where it’s offered, an authenticator app otherwise. Text-message codes are better than nothing, but they can be phished or redirected.
4. Protect your credit file if your birth date, address or ID leaked.
   • In Quebec (since February 2023) and Ontario (since July 1, 2026), you can place a free security freeze, which Equifax calls a credit lock. It stops your file being shared to open new credit. You have to set it with Equifax and TransUnion separately, and lift it when you apply for credit yourself.
   • Everywhere else, ask both bureaus for a fraud alert, which asks lenders to confirm it’s really you. In Ontario an alert can cost up to $5 and lasts six years.
5. Check your credit reports. Look for accounts or inquiries you don’t recognise. In Ontario, you can get your report online from either bureau once a month for free.
6. Watch your statements for a couple of months. Report anything odd to your bank or card issuer right away.
7. Report actual fraud. If someone does use your information, report it to your local police and to the Canadian Anti-Fraud Centre (1-888-495-8501), and tell both credit bureaus.

What you can skip

• Paying for something out of fear. If the company offers free credit monitoring, it can be worth accepting. You don’t need to buy anything else to be safe.
• Changing everything at once. Start with the account that leaked and the accounts that share its password. That covers most of the real risk.
• Searching for your data on the dark web yourself. It isn’t useful, and it isn’t safe.

The goal isn’t to make a breach not have happened. It’s to make the leaked data useless.

How Frame helps

Frame keeps a catalog of known breaches. You can mark the ones you were part of, and your to-do list turns into the specific steps for what leaked. We never collect or store the leaked records.

Sources

• Office of the Privacy Commissioner of Canada, What you need to know about mandatory reporting of breaches of security safeguards
• Office of the Privacy Commissioner of Canada, PIPEDA Principle 9: Individual Access
• Equifax Canada, Credit lock FAQ (Quebec and Ontario)
• Government of Ontario, Credit reports, updated June 30, 2026
• Financial Consumer Agency of Canada, Checking your credit report for errors and fraud
• Canadian Anti-Fraud Centre, antifraudcentre.ca