A retailer discovers that an attacker accessed customer records through an employee account. The broker tells management to preserve the logs and notify the cyber insurer. Someone else assumes the insurer will deal with all regulatory reporting. A week can pass before the company realizes that the insurer's incident response process and the organization's privacy obligations are separate.
The Office of the Privacy Commissioner of Canada explains the federal breach reporting rules for organizations subject to the Personal Information Protection and Electronic Documents Act. A breach creating a real risk of significant harm must be reported to the Commissioner, affected individuals must be notified, and records of breaches must be retained. These duties don't depend on whether the insurer accepts the claim. Provincial private sector privacy regimes can create different obligations, so the company must establish which law applies.
Two clocks, two decisions
The insurance side begins with the actual policy. Some policies require prompt notice, consent before certain expenses, use of approved vendors or cooperation in an investigation. The details vary by wording and coverage part. Calling a broker may be sensible, but it doesn't necessarily satisfy a policy's formal notice requirement.
The privacy side starts with what information was involved, who was affected, the sensitivity of the information and the likelihood of misuse. The company's incident team should preserve evidence, contain further access, assess the privacy risk and document decisions. A reportability assessment isn't merely a question of how much the incident response will cost.
If a forensic vendor reports that no exfiltration was found, management should still ask what the evidence can actually establish. Missing logs, undetected access and uncertainty about the scope of a breach aren't the same thing as a confirmed absence of risk.
What useful insurance coordination looks like
The best outcome is a response plan that assigns responsibility instead of promising that a policy will take care of everything. Identify who contacts the insurer, who obtains legal advice about statutory notifications, who communicates with affected individuals and who approves the expense of specialist help. The organization should record policy deadlines alongside statutory deadlines without assuming they coincide.
Cyber insurance can help fund parts of the response, subject to the contract. It cannot transfer the legal accountability of an organization that holds personal information to an insurer merely because the claim has been opened.