Meridian Accounting Group Ltd.

Report to the Office of the Privacy Commissioner of Canada (OPC)

PIPEDA requires that where a breach of security safeguards involving personal information creates a real risk of significant harm to individuals, the organization must report the breach to the Privacy Commissioner of Canada. The report must contain prescribed information about the nature of the breach, the personal information involved, the number of individuals at risk, and the steps taken or planned.

Notify Affected Individuals (PIPEDA)

PIPEDA requires that where a breach creates a real risk of significant harm, the organization notify every individual whose personal information was involved in the breach and who is at risk of harm. The notification must contain prescribed information including a description of the breach, the personal information involved, steps the individual can take to protect themselves, and contact information for follow-up questions.

Report to the Office of the Information and Privacy Commissioner of Alberta (OIPC AB)

Alberta PIPA requires that where a breach of security safeguards creates a real risk of significant harm, the organization report the breach to the OIPC AB. The report is submitted by email to breachnotice@oipc.ab.ca using the OIPC AB prescribed form, which collects information about the organization, the breach, the RROSH determination, individual notification steps taken, and contacts at other regulators if applicable.

Notify Affected Individuals (Alberta PIPA)

Alberta PIPA requires that where a breach of security safeguards creates a real risk of significant harm, the organization notify the affected individuals as soon as reasonably practicable. The statute prescribes five specific elements that must appear in the notice: description of the breach; personal information involved; steps taken to reduce risk; contact information for questions; and further steps the individual may take. All five elements are mandatory — a notice missing any element does not satisfy the obligation.

Step 1 — Contain the breach

Stop ongoing exposure immediately: revoke access, reset credentials, isolate affected systems, and preserve evidence. Document every containment action with timestamps. Do not overwrite or delete any logs or system state that may be needed for investigation.

Step 2 — Activate the Internal Incident Record

Open the Internal Incident Record included in this package and begin logging every action taken. This record is your regulatory defence — gaps in documentation are treated by regulators as gaps in response. Assign a single accountable owner for the record.

Step 3 — Notify your cyber liability insurer

Check your cyber liability policy for the notification window and required content. Late notification can void coverage. Preserve all incident documentation for the insurer. Your insurer may have preferred vendors for breach coaching, forensic investigation, and legal counsel.

Step 4 — File the OPC PIPEDA Breach Report and notify affected individuals (PIPEDA)

Complete all placeholder fields in the OPC report draft and the individual notification letter. Have qualified privacy counsel review both before filing. Send the individual notification letter simultaneously with or as soon as practicable after the OPC report.

Step 5 — File the OIPC AB PIPA Report and send the AB PIPA Individual Notice simultaneously

Submit the OIPC AB report by email to breachnotice@oipc.ab.ca using the official form. Send the AB PIPA Individual Notice to affected individuals simultaneously or as close to simultaneously as possible. Simultaneous submission qualifies the matter for the April 2024 OIPC AB streamlined review process, which closes with a private letter rather than a published investigation report. See your OIPC AB report for the exact simultaneous notification procedure.

Step 6 — Conduct a post-incident review

After all obligations are satisfied, document what caused the breach, what controls failed, and what changes are being made to prevent recurrence. Retain this review as part of your incident record for a minimum of 24 months.

PIPEDA (Federal) assessment returned a verdict of RROSH — real risk of significant harm. Six risk factors were identified that collectively crossed the reporting threshold. The obligations triggered by this determination are set out in the Your Obligations section above. Note: High Watermark scoring was applied to one or more uncertain answers — the actual risk may be lower once facts are confirmed.