A Practice Note addressing legal requirements and considerations when handling data breaches, cyberattacks, and other information security incidents in Canada or drafting data breach response notifications regarding personal data originating from Canada. It discusses the Personal Information Protection and Electronic Documents Act, the Breach of Security Safeguards Regulations, and substantially similar provincial private sector privacy laws, including Alberta's Personal Information Protection Act and Québec's Act respecting the protection of personal information in the private sector. This Note also includes Office of the Privacy Commissioner of Canada guidance and Government of Canada programs, including the Canadian Centre for Cyber Security. For more Canadian cybersecurity resources, see Cybersecurity Toolkit (Canada).