You must be prepared to act promptly in the event of a privacy breach. A privacy breach is a situation where personal information that is in your possession may have been accessed by someone outside your organization.
As part of your disaster planning, assemble all you need to know in a section of your office manual. Prepare as if the person reading it has no idea what to do. You must plug the breach, which will involve your IT person. You must also notify the Privacy Commissioner and NSBS.
Please also call NSBS to report the issue.
Resources for Responding to Privacy Breaches
Office of the Privacy Commissioner of Canada, “What you need to know about mandatory reporting of breaches of security safeguards” (October 2018, revised August 2021). priv.gc.ca.