If there is a breach

The thing most vendors do not tell you

Under Canadian federal privacy law the duty to report a breach to the Privacy Commissioner, and to notify the people affected, falls on the organisation that has the information under its control. For your applicants and residents, that is your company. Not Kaza.

We cannot make that report on your behalf and we will not pretend otherwise. What we can do is make sure you are never the last to know.

What we commit to

• We tell you without undue delay, and we aim to be inside 72 hours of confirming a breach that affects your company. We do not wait until we have finished investigating: a partial picture you can act on beats a complete one that arrives too late.
• We tell you what we actually know: what happened, when, which information was involved, how many people, what we have done, and what we do not yet know.
• We give you what you need for your own record. Canadian law requires you to keep a record of breaches; we will give you ours in a form you can file.
• We do not quietly decide it was not serious. Whether the threshold for reporting is met is your judgement to make, on your data, so we hand you the facts rather than the conclusion.

What you will need to do

Once we tell you, assess whether the breach creates a real risk of significant harm to anyone. If it does, you must report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as feasible. You must keep a record of the breach either way, whether or not it was reportable.

If a province’s tenancy or privacy regulator also has to hear about it, that is your call too: you know which regulators you answer to. We will help with anything factual.

If the breach is at one of our sub-processors

The same commitment applies. The companies that receive your data are named on the sub-processors page, and a breach at one of them that touches your data is a breach we tell you about on the same clock. Your accountability under Canadian law does not stop at our boundary, so neither does our notice.

Reporting something to us

If you think something has gone wrong (an account you did not recognise, a document reachable that should not be, anything at all), send it to info@3d3d.ca. A false alarm costs an email. The other kind costs considerably more.