Cyberattacks on small businesses are rising sharply across Canada. BC entrepreneurs face both the operational risk of a breach and real legal obligations under Canadian privacy law. Here is what you need to know — and do.
## Why Cybersecurity Is Now a Legal Issue for BC Business Owners
Cybersecurity used to feel like an enterprise problem — something for large corporations with IT departments and dedicated security teams. That perception is dangerously outdated.
According to the Business Development Bank of Canada (BDC), small and medium-sized businesses now represent the majority of ransomware targets in Canada. They are attractive precisely because they often lack the security measures of larger organisations, while still holding valuable data — client records, financial information, employee files, and payment details.
For BC business owners, a cyberattack is not just an operational disruption. It can trigger real legal obligations and potential liability.
## Your Legal Obligations Under Canadian Privacy Law
### PIPEDA and BC's PIPA
Most BC businesses are subject to either the federal *Personal Information Protection and Electronic Documents Act* (PIPEDA) or BC's provincial *Personal Information Protection Act* (PIPA). Both laws require businesses to:
- Collect only the personal information they actually need
- Protect that information with appropriate security safeguards
- Notify individuals and, in some cases, regulators when a breach occurs that poses a real risk of significant harm
The mandatory breach reporting requirement under PIPEDA has been in force since 2018. If your business experiences a breach and fails to report it when required, you may face fines and regulatory action — in addition to any civil liability to affected individuals.
### What Counts as a Reportable Breach?
Not every security incident requires a formal breach notification. The test under PIPEDA is whether the breach creates a "real risk of significant harm" to the individuals whose information was affected. Significant harm includes:
- Identity theft or fraud
- Financial loss
- Reputational damage
- Physical harm
When in doubt, the safer approach is to report. A business lawyer can help you assess whether a specific incident meets the reporting threshold and draft the required notifications.
### Contracts and Vendor Liability
If your business shares personal information with vendors — a payroll processor, a cloud storage provider, a marketing platform — you remain responsible for how that information is protected. Your contracts with vendors should include data security requirements, breach notification obligations, and clear allocation of liability.
Many standard vendor contracts are written to favour the vendor. Having a lawyer review these agreements before you sign is far less expensive than dealing with the consequences of a breach that your vendor caused but your contract does not address.
## The Most Common Cyber Threats Facing BC Small Businesses
### Phishing and Business Email Compromise
Phishing emails — designed to trick employees into clicking malicious links or revealing passwords — are the entry point for the majority of small business breaches. Business email compromise (BEC) is a more targeted version, where an attacker impersonates a supplier, executive, or client to redirect payments.
Training employees to recognise suspicious emails, verify payment requests through a second channel, and report anything unusual is the single highest-return security investment a small business can make.
### Ransomware
Ransomware encrypts your business's files and demands payment for the decryption key. For a small business without offsite backups, a ransomware attack can be devastating. The BDC's cybersecurity guide recommends the "3-2-1" backup rule: three copies of your data, on two different media, with one copy stored offsite or in a separate cloud environment.
### Weak Passwords and No Multi-Factor Authentication
The majority of business account compromises involve weak or reused passwords. Requiring employees to use a password manager and enabling multi-factor authentication (MFA) on all business accounts — email, banking, accounting software, cloud storage — dramatically reduces the risk of unauthorised access.
## Practical Steps BC Business Owners Can Take Now
### Conduct a Simple Risk Assessment
You do not need an IT consultant to start. Walk through your business and answer:
- What personal information do we collect and store?
- Who has access to it?
- How is it backed up?
- What would happen if we lost access to our systems for a week?
The answers will tell you where your most significant vulnerabilities are.
### Update Your Contracts
Review your client contracts and vendor agreements. Do they address data security? Do they specify who is responsible if a breach occurs? Do they include a breach notification requirement?
If your standard contracts were drafted several years ago, they may predate current privacy law requirements. A business lawyer can review and update them.
### Have a Breach Response Plan
Knowing in advance what you will do if a breach occurs reduces the chaos — and the legal risk — of responding in the moment. A basic plan should include:
1. Who to notify internally (a decision-maker needs to be involved immediately)
2. Who to call for technical assistance
3. How to assess whether the breach is reportable under PIPEDA or PIPA
4. How to notify affected individuals if required
5. How to document the breach and your response
### Cyber Liability Insurance
Cyber liability insurance is increasingly available and affordable for small businesses. It can cover costs including breach notification, credit monitoring for affected individuals, legal fees, and business interruption losses. Review your existing business insurance policy — many standard policies do not cover cyber incidents, and a specific endorsement or separate policy may be needed.
## The Intersection of Cybersecurity and Business Law
A cyberattack creates legal consequences that a business owner may not anticipate. If client data is exposed, affected individuals may have grounds for a civil claim. If the breach results from a vendor's failure, you may have a claim against the vendor — but only if your contract supports it. If the breach involves employee data, employment law obligations come into play.
At Sea to Sky Law, Andrew Liggett works with BC business owners on the legal foundations that protect them — including reviewing contracts, advising on privacy obligations, and supporting businesses through disputes that arise from data incidents. With 35 years of experience in BC business law, he understands both the regulatory landscape and the practical realities of running a business in this province.
If you have questions about your legal obligations around data protection or want to review your business contracts, reach out for an intake call.
If your business collects, uses, or discloses personal information about individuals in the course of commercial activity, BC's Personal Information Protection Act (PIPA) or the federal PIPEDA likely applies. This includes client records, employee files, and payment information. Most BC businesses are covered by one or both laws.
Under PIPEDA, you must report breaches that pose a 'real risk of significant harm' to the federal Privacy Commissioner and notify affected individuals. BC's PIPA has its own notification requirements. A lawyer can help you assess whether a specific incident meets the reporting threshold.
Potentially yes, depending on what data was involved and whether you took reasonable steps to protect it. BC courts have recognised privacy torts in certain circumstances. The best protection is having appropriate security measures in place and ensuring your contracts clearly address data protection responsibilities.
Look for provisions that require the vendor to maintain specific security standards, notify you promptly of any breach involving your data, and accept liability for breaches caused by their systems or employees. Standard vendor contracts often exclude or limit this liability — review them carefully before signing.