Vulnerability
Vulnerability is a general term for a weakness that exposes a business to harm, most often used for security weaknesses in software or systems that could allow unauthorized access to data. It is a technical and business term rather than a legal one, but security weaknesses can create legal obligations and liability, particularly where personal information is involved.
How BC law treats it
There is no general legal duty to eliminate every vulnerability, but the Personal Information Protection Act, SBC 2003, c 63, s. 34 requires organizations to make reasonable security arrangements to protect personal information. Other duties may arise from contracts and the law of negligence.
What it means for your business
Regular security reviews, patching and access controls help show that your security arrangements were reasonable.
Risks and common mistakes
A known but unpatched vulnerability that leads to a data breach can undermine your defence that security arrangements were reasonable.
Fulcrum's privacy and data protection lawyers can help with these issues.
General information about British Columbia and Canadian law, current to October 2026. It is not legal advice.
