What to do if you receive a privacy complaint or a letter from a privacy commissioner

Identify which regulator sent it and under which law. Federally regulated and most private-sector organizations outside Quebec, Alberta and BC fall under PIPEDA, overseen by the OPC. Ontario health information custodians answer to the Information and Privacy Commissioner of Ontario (IPC) under PHIPA. BC private organizations fall under BC's PIPA and the OIPC. Alberta and Quebec have their own commissioners and laws.

Then identify what it is: a complaint from an individual (often about access to their information, consent, or a breach), a follow-up to a breach report you filed, or an inquiry the regulator started itself. Note every deadline and every specific question. If a deadline is tight, ask early and in writing for more time; don't let it pass.

• Put a hold on email, files and chat records that relate to the complainant or the incident; suspend routine deletion for them.
• Preserve system logs that show access to the relevant information. Many logs roll over automatically (Microsoft 365 Audit Standard keeps records for 180 days by default).
• Keep the complainant's original request and your responses, with dates.
• Tell the small group handling it not to alter or tidy up records.

Regulators will ask what your organization had in place, not just what happened. Gather your privacy policy and any internal privacy program documents; the name of the person accountable for privacy (PIPEDA requires an organization to designate one); your breach records, which PIPEDA requires you to keep for every breach of security safeguards for 24 months; any breach report you filed and the notices you sent; training records; and relevant contracts with service providers.

If an access request is at the heart of the complaint, assemble the request, your search and response, and any exemptions you relied on.

Have your lawyer review the response before it goes out. The response should be accurate, complete for what was asked, and consistent with what you've told affected individuals, insurers and anyone else. Avoid speculation; where something is unknown, say so and explain how you're finding out. Technical findings should be in plain language with the evidence available if requested.

We can provide the technical side: log analysis, a factual report on safeguards and what happened, and support for counsel. Where a matter becomes contentious, we also offer expert-witness work.

Whatever the outcome, fix what the complaint exposed: a slow access-request process, an over-broad retention habit, a missing MFA control, or a vendor contract without breach terms. Regulators look more favourably on organizations that can show they acted, and the fixes reduce the chance of the next complaint. Primary sources worth reading are the OPC's guidance on mandatory breach reporting, the IPC's PHIPA guidance, OIPC BC's privacy breach checklist, and PIPEDA Schedule 1's fair information principles.