Industry
Cyber insurance for a US firm with Canadian customers: PIPEDA, Law 25 and policy coverage
Cyber insurance for a US firm with Canadian customers: PIPEDA and Quebec Law 25 breach duties, what US policies pay, and the factors that drive premium.
What to take away
- A US firm holding records on Canadian customers falls under Canadian privacy law, so its cyber policy must answer PIPEDA and provincial breach duties, not only US state statutes.
- Reporting duties start the claim clock. PIPEDA requires notice to the Privacy Commissioner of Canada when a breach creates a real risk of significant harm, and Quebec, Alberta and British Columbia add their own triggers.
- Most US cyber forms pay notification costs and regulatory defence, but territory wording, sublimits and the Canadian counsel panel often need an endorsement.
- Premiums track record counts by province, Canadian revenue, sector and security controls. The border itself does not carry a surcharge.
For a US commercial insurance buyer, the Canadian rules are claim triggers, not the product. The coverage is still a US-issued cyber liability policy, and the premium is what a US business pays for that protection.
Buyers should compare limits, sublimits, territory wording and endorsements against the Canadian records and revenue they report. Ask your broker to quote the Canadian exposure as part of the same commercial coverage review.
Where Canadian privacy law reaches a US policy
Privacy law follows the customer, not the server. A US software firm holding records on people in Ontario, Quebec or Alberta keeps Canadian obligations. The province where the customer lives usually decides which notification rule applies, even when the breach happens in Ohio and the contract selects Nevada law.
PIPEDA applies to organizations that collect personal information in the course of commercial activity in Canada. A real and substantial connection is enough. The trigger is data about people in Canada, not a physical office.
A booth at a Toronto trade show is a different exposure. Cyber insurance for Ontario booth renters covers the licensing rules and breach duties that start a claim there.
The Canadian breach rules that start a claim
PIPEDA's breach of security safeguards provisions have applied since November 1, 2018. They require a report to the Privacy Commissioner of Canada when a breach creates a real risk of significant harm, notice to affected individuals, and breach records kept for 24 months.
Provincial law sits on top. Alberta's Personal Information Protection Act and British Columbia's PIPA use the same real risk of significant harm test. Quebec's Law 25 requires notice to the Commission d'acces a l'information and to affected people when there is a risk of serious harm.
Quebec also raised maximum administrative penalties to CAD 25 million or 4 percent of worldwide turnover. Regulators expect a written incident log and prompt notice.
What a US cyber policy pays for Canadian customer data
| Coverage part | Typical response | Watch for |
|---|---|---|
| Breach response | Forensics, notification, call centre, credit monitoring | A notification sublimit that runs out early |
| Regulatory defence | Counsel for the OPC or a provincial commissioner | Fines and penalties, often excluded |
| Privacy liability | Defence and settlement of Canadian class actions | Wording limited to suits filed in the United States |
| Network interruption | Lost income and extra expense after an outage | Waiting hours and an annual aggregate |
Network interruption coverage follows the shape of business interruption insurance, with waiting periods and coinsurance clauses. A commercial general liability policy does not fill the gap, since it typically excludes stolen property and is silent on privacy claims.
US cyber policy: Canadian data
Coverage part
- Breach response
- Forensics, notification, credit monitoring
- Regulatory defence
- Counsel for OPC or provincial
- Privacy liability
- Canadian class action defence
- Network interruption
- Lost income, extra expense
Typical response
- Breach response
- Sublimit runs out early
- Regulatory defence
- Fines often excluded
- Privacy liability
- US-filed suits only
- Network interruption
- Waiting hours, annual aggregate
Watch for
- Breach response
- Regulatory defence
- Privacy liability
- Network interruption
How carriers price Canadian exposure
- Count records by province and separate Ontario, Quebec, Alberta and British Columbia, because each regulator has its own expectations.
- Report Canadian revenue and the share of total revenue it represents.
- Document controlsmulti-factor authentication, encryption, tested backups, vendor reviews and a written incident response plan.
- Disclose prior incidents, Canadian complaints and any correspondence from the Office of the Privacy Commissioner.
- Name the Canadian breach counsel, forensics firm and notification vendor you would call.
Carriers seldom add a Canadian surcharge. They adjust the base rate, then attach sublimits and endorsements. Weak controls cost more than the border does.
Employee records bring employment duties into the rating. A US business with Canadian staff faces payroll data questions that shift sublimits and endorsements.
Example: a Quebec customer list in a US system
Consider a US payroll platform whose users sit mostly in Quebec and Ontario. Ransomware encrypts a server in Denver. Quebec clients must be told under Law 25, and Ontario clients fall under PIPEDA.
The claim runs on three lines: forensics, notification in French and English, and regulatory defence. If the territory clause is limited to the United States, the insurer may decline the Canadian notification invoice. Ask before you bind.
Class actions, regulators and defence costs
Privacy class actions have been certified in Ontario, British Columbia and Quebec against banks, retailers and telecoms. Quebec's Law 25 added a private right of action for unlawful processing of personal information. Defence costs across several provinces can dwarf the notification invoice.
Regulators have teeth. The Privacy Commissioner of Canada can seek a compliance order in Federal Court. Alberta and British Columbia commissioners can issue orders, and Quebec's Commission d'acces a l'information can impose administrative penalties.
Bind checks before the policy is issued
- Confirm the territory clause covers claims, regulators and claimants outside the United States.
- Check that the definition of personal information does not exclude Canadian statutory definitions.
- Verify the notification sublimit and whether it applies per event or annually.
- Confirm the vendor panel includes Canadian breach counsel and a French-language notification provider.
- Ask how the carrier treats administrative penalties imposed under Quebec's Law 25.
If the paper is issued by a Canadian branch, that entity files returns with the federal regulator, which publishes its reporting framework for insurers it supervises.
