Security safeguards: the OPC's October 2026 decisions

In 13 days, the Office of the Privacy Commissioner of Canada (OPC) made 3 security safeguards files public. On October 14, 2026, it closed its investigation into WestJet, satisfied with the enhanced measures taken after the 2025 cyberattack. On October 26, it announced that Loblaw had committed, in a letter signed on October 21, to strengthen its measures after a breach affecting about 2 million people. On October 27, it opened an investigation into Navigate360, the company that provides the tip management platform used by Canadian Crime Stoppers chapters.

What the sources say

WestJet, investigation closed. According to the compliance letter signed on July 8, 2026, the breach on or around June 12, 2025 affected approximately 5,164,000 Canadian employees and customers. An unauthorised third party used social engineering to gain access to the account of an employee with administrative privileges, posing as that employee, which allowed it to bypass multi-factor authentication (MFA). WestJet reported the breach to the OPC on June 14, 2025. The measures described include mandatory MFA for WestJet Rewards accounts, stronger MFA methods for privileged accounts (authentication apps, hardware keys), least privilege, and live video or in-person recognition for the vast majority of employee credential and MFA resets. WestJet committed to deliver by August 7, 2026 the summary report of an assessment by an independent external firm approved by the OPC, then to respond to its recommendations by September 7. On October 14, the Commissioner found the commitments met: "This case is a testament to the value of early engagement between businesses and authorities on serious incidents."

Loblaw, commitments signed. The October 21, 2026 letter states that Loblaw confirmed unauthorised access on March 5, 2026. The threat actor used compromised credentials for a platform used for quality assurance activities, with earliest access likely on February 23. The affected information includes name, email, address, phone number, date of birth, loyalty account number, purchase order details and the last 4 digits of payment cards. Loblaw determined that the real risk of significant harm threshold was met. After a public advisory on March 10, it updated it on October 2 at the OPC's request and started direct notifications on October 19, a delay it attributes to data analysis, de-duplication and validation. Its commitments: confirm all notifications by November 16, 2026, describe its validation and risk assessment methodology by January 31, 2027, deliver an independent external security assessment by October 31, 2027, and provide quarterly updates. The investigation remains open.

Navigate360, investigation opened. On October 27, 2026, the Commissioner opened an investigation into Navigate360, "the commercial organization that provides and manages the tip management platform used by Canadian Crime Stoppers' chapters." It will examine the security safeguards in place at the time of the breach. The OPC notes that PIPEDA generally does not apply to not-for-profit organisations, such as Crime Stoppers, and gives no further details.

Why it matters

PIPEDA principle 4.7 sets the rule: "Personal information shall be protected by security safeguards appropriate to the sensitivity of the information." Clause 4.7.2 adds that the nature of the safeguards varies with the sensitivity, amount, distribution and format of the information, and that more sensitive information should get a higher level of protection. All 3 files look at the safeguards in place at the time of the breach: what you add afterwards counts, but the investigation starts with what existed before.

The 2 letters follow the same pattern: measures already taken, an assessment by an independent firm, a written answer to each recommendation, fixed dates. Loblaw's adds a section on notifying affected individuals and on the risk assessment methodology. The OPC is asking not only that you notified, but how you made the decision.

Finally, the Navigate360 file shows that a provider holding your data can itself be the subject of the investigation. For the client, principle 4.1.3 still applies in full: an organisation is responsible for information transferred to a third party for processing. The OPC's September 10, 2026 guidance on third-party service providers is explicit: "Confirm how a data breach will be managed, including the roles and responsibilities of your organization, the provider, and any subcontractors."

What we think at Sentrix

1. Classify information by sensitivity, then calibrate the safeguards. That is the plain reading of principle 4.7: an inventory that says where the sensitive data sits and what protection it gets, see our PIPEDA page.
2. Protect resets like privileged access. The verified process WestJet describes for credential and MFA resets shows where the OPC is looking. Our identity and access service covers that step.
3. Write into the contract who does what in a breach. Provider, subcontractors, notice deadlines, log access: set before signing and tracked afterwards, as our third-party risk module does.
4. Keep the record and document the risk analysis. Every breach, reported or not, with the reasoning on real risk of significant harm. Our article on reporting a breach covers the content.
5. Prepare notification before you need it. Knowing in advance which personal information sits in which system, and whose it is, shortens the analysis and de-duplication step that comes before notices.
6. Have your safeguards assessed independently, without waiting. Both letters require it after the fact. Doing it beforehand gets you the same report on your own schedule, as with our cybersecurity posture assessment.

The next step

Take your 3 most sensitive systems and the 3 providers that hold the most personal information. For each, note the sensitivity level, the safeguards in place and who does what in a breach. Whatever is missing is your plan for the coming weeks. If you want to do this exercise with us, contact us.