Cyber liability

Cyber liability is the legal exposure a business faces when a cyberattack, data breach or system failure causes harm, including claims by affected individuals or customers, regulatory investigations, and its own costs of response and recovery. Cyber liability insurance is designed to cover some of these costs, depending on the policy.

How BC law treats it

Private businesses in BC are governed by the Personal Information Protection Act, SBC 2003, c 63, which requires reasonable security arrangements (s. 34) but currently contains no mandatory breach notification requirement, or by PIPEDA for federally regulated businesses and cross-border transfers. PIPEDA requires reporting breaches that pose a real risk of significant harm to the federal Privacy Commissioner and affected individuals (s. 10.1). FOIPPA applies to public bodies, not private businesses.

What it means for your business

A business should have an incident response plan and consider cyber insurance, reviewing what the policy actually covers.

Risks and common mistakes

Delay in containing and reporting a breach can increase legal exposure and harm customer trust.

For the full explanation, see our entry on Privacy breach.

General information about British Columbia and Canadian law, current to October 2026. It is not legal advice.