Canada's privacy regulator received 686 breach of security safeguards reports under PIPEDA in fiscal year 2024-25, according to the Office of the Privacy Commissioner of Canada's Annual Report to Parliament, published in June 2025. Those reports affected roughly 20 million Canadian accounts. The report count barely moved from the year before, but the causes behind it kept shifting toward unauthorized access.
How many PIPEDA breach reports did Canada receive in 2026?
686 breach of security safeguards reports were filed with the Office of the Privacy Commissioner of Canada (OPC) in fiscal 2024-25, the period covered by the regulator's most recent Annual Report to Parliament. That is down slightly from 693 reports the prior fiscal year and up from 681 two years earlier. Three straight years above 680 reports suggests the count has settled into a stable range rather than climbing or falling sharply.
Businesses covered by PIPEDA must report any breach that creates a real risk of significant harm, so this figure reflects only the reports that crossed that threshold, not every incident a covered organization experienced.
How many individuals were affected by PIPEDA breaches?
Roughly 20 million Canadian accounts were affected by reported breaches in fiscal 2024-25, according to the OPC. That is down from about 25 million accounts affected in 2023-24, but still nearly double the 12 million affected in 2022-23. The regulator's own report calls the 2024-25 total "concerningly high" even with the year-over-year decline.
Figure 1: Individuals affected by reported PIPEDA breaches, by fiscal year, in millions. Source: Office of the Privacy Commissioner of Canada, Annual Reports to Parliament, 2022-23 through 2024-25.
The swing between 12 million and 25 million across three years, on a roughly flat number of reports, shows that a small number of large-scale incidents drive most of the harm, a pattern also visible in the broader global data breach figures this post's companion piece tracks.
What is causing most PIPEDA breach reports?
Unauthorized access accounted for 81% of all breach reports filed in fiscal 2024-25, up from 75% the prior year and 66% two years before that. Unauthorized disclosure was the next most common cause at 13%, followed by loss and theft at 3% each. The steady climb in the unauthorized-access share points to a growing concentration of cyberattacks and credential compromises among the incidents organizations are reporting.
Figure 2: PIPEDA breach reports by cause, fiscal 2024-25. Source: Office of the Privacy Commissioner of Canada, Annual Report to Parliament 2024-25.
Loss and theft, the causes easiest to prevent with basic device and document controls, together explain only 6% of reports, which means most of this exposure now traces back to attacks on systems rather than misplaced paperwork or hardware.
Which industries report the most PIPEDA breaches?
The financial sector filed 31% of all breach reports in fiscal 2024-25, more than double the next-largest sector. Telecommunications followed at 12%, general services at 11%, and insurance and manufacturing tied at 7% each. Within the financial sector specifically, unauthorized access accounted for 172 of the 555 unauthorized-access reports the OPC received across every industry combined.
Figure 3: PIPEDA breach reports by industry sector, fiscal 2024-25, share of the 686 total reports. Source: Office of the Privacy Commissioner of Canada, Annual Report to Parliament 2024-25.
Financial institutions hold the kind of account credentials and payment data that make them a recurring target, which is consistent with the sector leading every fiscal year the OPC has published a breakdown for.
Are PIPEDA breach reports rising or falling year over year?
Report volume has held close to a stable band for three straight fiscal years: 681 in 2022-23, 693 in 2023-24, and 686 in 2024-25. That is a spread of only 12 reports across three years, even as the number of individuals affected swung from 12 million to 25 million and back down to 20 million.
Figure 4: PIPEDA breach of security safeguards reports received by fiscal year. Source: Office of the Privacy Commissioner of Canada, Annual Reports to Parliament, 2022-23 through 2024-25.
A flat report count alongside a volatile impact count means the number of organizations reporting a breach is not the story. The size of individual incidents is.
How does breach reporting compare to complaints filed with the OPC?
Complaints to the OPC are a separate track from breach reports, and they grew far faster in fiscal 2024-25. The regulator accepted 1,458 total complaints, a 32% increase over the prior year. Of those, 446 complaints were formally accepted for investigation, 39 were found well-founded, 331 were closed through early resolution, and 107 went through a standard investigation.
Businesses that must comply with PIPEDA can reduce both breach exposure and complaint risk with a policy that accurately describes how personal information is collected, used, and safeguarded. A privacy policy generator built for PIPEDA disclosure requirements keeps that language current without waiting for a complaint or a breach to force the update.
How does 2024-25 compare to prior PIPEDA reporting years?
| Fiscal year | Breach reports | Individuals affected | Leading cause |
|---|---|---|---|
| 2022-23 | 681 | ~12 million | Unauthorized access (66%) |
| 2023-24 | 693 | ~25 million | Unauthorized access (75%) |
| 2024-25 | 686 | ~20 million | Unauthorized access (81%) |
Source: Office of the Privacy Commissioner of Canada, Annual Reports to Parliament, 2022-23 through 2024-25.
Every year in this table shows the same leading cause growing its share, which is the clearest single trend in three years of PIPEDA breach reporting data.
The Bottom Line
686 PIPEDA breach reports in fiscal 2024-25 is not a dramatic swing from the 693 filed the year before, and that stability is easy to misread as good news. The real trend sits underneath the headline count: unauthorized access now drives 81% of reports, up from 66% two years ago, and the financial sector alone accounts for nearly a third of every report filed. Organizations covered by PIPEDA face rising odds that any breach they report will trace back to a compromised system rather than a lost laptop, which makes access controls and an accurate, current privacy policy the two most direct ways to reduce both breach risk and complaint risk at the same time.
Frequently Asked Questions
How many PIPEDA breach reports did Canada receive in 2024-25? 686 breach of security safeguards reports, according to the Office of the Privacy Commissioner of Canada's Annual Report to Parliament for fiscal 2024-25, published in June 2025, down slightly from 693 the year before.
How many people were affected by PIPEDA breaches? Roughly 20 million Canadian accounts were affected by reported breaches in fiscal 2024-25, down from about 25 million in 2023-24 but still nearly double the 12 million affected in 2022-23, per the OPC.
What causes the most PIPEDA breach reports? Unauthorized access, which accounted for 81% of all breach reports filed in fiscal 2024-25, up from 75% the prior year, according to the OPC's Annual Report to Parliament.
Which industries report the most PIPEDA breaches? Financial services, which filed 31% of all breach reports in fiscal 2024-25, followed by telecommunications at 12% and general services at 11%, per the OPC's sector breakdown.
Where the Numbers Come From
- Office of the Privacy Commissioner of Canada. (2025). "Annual Report to Parliament 2024-2025: Prioritizing privacy in a data-driven world." 686 breach of security safeguards reports, roughly 20 million individuals affected, and the cause and sector breakdowns for fiscal 2024-25.
- Office of the Privacy Commissioner of Canada. (2024). "Annual Report to Parliament 2023-2024." 693 breach reports and approximately 25 million individuals affected, the prior-year comparison figures used throughout this post.
- Office of the Privacy Commissioner of Canada. (2023). "Annual Report to Parliament 2022-2023." 681 breach reports, the earliest year in this post's three-year comparison.
- Office of the Privacy Commissioner of Canada. "Privacy Breaches." General guidance on PIPEDA's breach of security safeguards reporting requirement and the real-risk-of-significant-harm threshold.
Note: All figures verified as of October 2026. The OPC has not disclosed a fixed sample-size methodology beyond the reports it directly receives under PIPEDA, so these figures cover only breaches that met the mandatory reporting threshold, not every incident that occurred. Breach data is refreshed annually when the OPC publishes its Annual Report to Parliament, typically each June.
