Trust & Data
Incident Response Commitment
If information we are responsible for is lost, accessed without authorization or disclosed by mistake, this is what we do.
- Contain. Stop the exposure: revoke access, change credentials, isolate the affected files.
- Tell you first. Notify the affected client within 24 hours of discovery, with what we know and what we do not yet know.
- Assess the harm. Work with you to decide whether there is a real risk of significant harm to any person.
- Notify as required. Where Alberta's Personal Information Protection Act or another applicable law requires it, notify the Office of the Information and Privacy Commissioner and affected individuals, in coordination with you. For Nation clients, we follow your direction on how your community is informed.
- Report in writing. Provide a written account within 10 business days: what happened, what was affected, what we changed.
- Fix the cause. Change the process or setting that allowed it, not just the symptom.
Report a concern: [email protected]
Questions about this page?
Email [email protected] and a person will reply within one business day.