Privacy and Information Security Incident Reporting

As required under the Protection of Privacy Act (POPA), the University of Alberta must protect personal information in its custody or control. A privacy incident occurs when there is unauthorized access, collection, use, disclosure, destruction or loss of personal information held by a public body. 

Any member of the University who becomes aware that a privacy incident has occurred, must: 

  • take immediate action to stop and contain the incident; and
  • immediately report the incident to the Information, Privacy and Records Management Office (IPRMO) and the Office of the Chief Information Security Officer (CISO) within 24 hours of detecting an incident. If the Incident involves Research Records, contact the approving research ethics board.

The IPRMO and CISO will determine whether or not the incident is a privacy breach and determine next steps, including notifications.

Important Information: If there exists a Real Risk of Significant Harm (RROSH) to an individual as a result of the incident, the University must give notice, without unreasonable delay, of the incident to affected individual(s), the Information and Privacy Commissioner, and the Minister responsible for POPA. If you believe your incident has a RROSH, contact the IPRMO. The IPRMO is responsible for determining if a privacy incident qualifies as a RROSH.

For additional information, please see the University’s Privacy and Information Security Incident Reporting and Response Procedure.

DEFINITIONS:

  • Having custody of a record, that relates to University operations, means having physical possession of it.
  • Having control of a record means having the power or authority to manage, restrict, regulate or administer the use or disclosure of the record.
  • Personal Information means recorded information about an identifiable individual, including but not limited to: name, home address, personal email address, age, and an identifying number assigned to the individual.


Employees: To report a Privacy and Information Security Incident, please please complete and submit the following form to the IPRMO and CISO:

Report a Privacy and Information Security Incident Now

Complaint: If you believe your personal information has been improperly collected, used, or disclosed by the University, you can submit a privacy complaint to the IPRMO at privacy@ualberta.ca and CISO at ciso@ualberta.ca.