Protecting Workplace Information Course: Lessons 2026

Lesson 1: Classifying information and need-to-know

Classifying information means sorting it by how much harm it could cause if it were lost, changed or shared with the wrong people. The label tells everyone at a glance how to store, share and dispose of it, so the most sensitive information gets the strongest protection. This also helps meet privacy law: under PIPEDA, personal information must be protected in a way that is appropriate to how sensitive it is.

A common business scheme

No law sets the labels a private business must use. Many employers use four levels, like the example below. Always follow your own employer's labels and rules.

A real example: the Government of Canada

The federal government uses two sets of levels. Protected levels are for harm to a person, an organization or the government, other than the national interest. Classified levels are for harm to the national interest, such as Canada's defence.

Labelling tips

• Classify a document when you create it, and mark it at the top and bottom.
• Label a document at the level of its most sensitive part, because the whole document needs the protection that part needs.
• Combined records can be more sensitive than each part. National Defence gives this example: one address might be Protected A, but 10,000 addresses would be at least Protected B.
• No label does not mean public. Information is only released through your organization's approved process.
• If you are not sure, protect it at the higher level until you have asked the owner or your security officer.

Need-to-know

Need-to-know means you get access only to the information you need to do your job. A senior title, rank or security clearance does not, by itself, give anyone the right to see something. The Privacy Commissioner advises limiting employee access to sensitive files on a need-to-know basis.

It works both ways. Before you share, ask: does this person need it for their work? Before you open a file, ask: do I need it for my task? Curiosity is never a business reason.

Questionário temático 1: Classifying information and need-to-know

Lesson 2: Personal information and Canadian privacy law

Under PIPEDA, personal information is any factual or subjective information, recorded or not, about an identifiable person. Examples include a name, age, ID numbers, income, ethnic origin, opinions, evaluations, disciplinary actions, employee files, credit records and medical records.

PIPEDA does not cover business contact information (such as a work phone number or work email) when it is used only to reach someone about their job. A personal email address is different. In a 2022 Saskatchewan case under that province's law for local authorities, the Information and Privacy Commissioner found that personal email addresses were personal information.

Which law applies?

Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador have health information laws that are substantially similar to PIPEDA. Alberta and British Columbia also have laws covering employee information. The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA and the Privacy Act; each province and territory has its own commissioner or ombudsman.

The 10 fair information principles

Sensitive information

Health and financial information are generally sensitive. So are ethnic and racial origin, political opinions, genetic and biometric data, sexual orientation, and religious beliefs. The OPC also says any information can be sensitive, depending on the context. A list of names is ordinary in one place, but very private if it lists people at a support group meeting.

Three kinds of safeguards

Questionário temático 2: Personal information and Canadian privacy law

Lesson 3: Sharing information safely

Many privacy breaches are everyday mistakes, not hacks. Alberta's Privacy Commissioner lists misdirected email, fax or mail among the most common privacy breaches.

Four questions before you share

1. Am I allowed to share this? Check its label and your policy.
2. Does this person need it to do their job?
3. Am I sharing only the minimum?
4. Am I using an approved, secure way to send it?

Under PIPEDA, personal information may be used or shared only for the purpose it was collected for, unless the person consents or the law requires it. A new purpose needs new consent. When you give copies to others, remove or black out personal information that is not needed for the task.

Email mistakes and how to avoid them

A real case: in 2022, the volunteer board chair of a small community in Saskatchewan sent a group email without BCC, so every recipient could see everyone's personal email address (the complaint said there were over 200). The Commissioner found this was a privacy breach and said the containment steps were not enough; steps such as trying to recall the email or asking recipients to confirm they deleted it should be considered. The community then moved to an email platform that can send mass emails without showing other addresses.

If you send something to the wrong person

Tell your supervisor or privacy officer right away, as your policy says. The OPC suggests asking the recipient to delete it, return it securely or hold it for collection.

Conversations

Do not discuss sensitive information in public places such as elevators and cafés, or with anyone who does not need to know. On the phone, be aware of anyone who might be listening.

Public AI tools

Government of Canada guidance says never to put protected, classified or personal information into public generative AI tools, and to use public tools only with unclassified information. Get Cyber Safe warns that once you give data to a tool, you lose control over where it goes: it may be stored, shared or used to train the tool. Use only tools your employer approves.

Questionário temático 3: Sharing information safely: email, talk and AI tools

Lesson 4: Printing, storage, retention and disposal

Clean desk, locked screen

• When you leave your desk, even briefly, put sensitive papers in a locked drawer and lock your screen.
• Keep USB keys and other media in a locked cabinet, and lock cabinets at the end of the day.
• Collect printouts right away. National Defence tells its staff not to leave Protected B documents at the printer. If your printer has a secure release (a card or PIN at the machine), use it.

Keep it only as long as needed

Under PIPEDA, personal information should be kept only as long as needed for the purposes it was collected for. The OPC says there is no one-size-fits-all retention period. If information was used to make a decision about a person, such as a hiring decision, keep it long enough for that person to see it and challenge the decision.

Keeping information "just in case" is risky: the more you hold, the bigger the harm if there is a breach. But do not destroy records early either, because laws and appeal rights can require a minimum period. A retention schedule sets a minimum and a maximum period for each type of record.

Ways to dispose of information

• Securely shred paper that holds personal information instead of putting it in the recycling or garbage.
• Remember all copies and backups, not just the main file.
• Photocopiers, printers, phones and computers can all store data. Fully delete it before a device is disposed of or sold. Send old devices to the person your employer names to arrange data destruction.
• If media will be reused by others outside your control, use a stronger method. If it will not be reused, destroy it.
• Keep records waiting for disposal in a secure, access-restricted area.
• If a shredding company is hired, your organization remains responsible. It should check the company, use a contract and do spot-checks.

Questionário temático 4: Printing, storage, retention and disposal

Lesson 5: Remote work, devices and cloud services

Taking information out of the office

British Columbia's Privacy Commissioner gives these tips:

• Take personal information out of the office only when your job requires it, and take the minimum you need.
• Take copies and leave the originals at the office. Get approval and use any sign-out process.
• Do not read work records in public. If you must, stop others from seeing them, for example with a privacy screen filter.
• Do not use personal email to move work records.
• When you are done, return the records or securely destroy the copies.

Your home workspace

• Lock your device when you step away, and set it to lock automatically after a short idle time.
• Do not let family or friends use the laptop you use for work.
• Keep work papers in a locked drawer or cabinet that only you can open.
• Be aware of anyone who might hear your calls or see your screen.
• Change the default password on your home Wi-Fi router to a strong passphrase.
• If you use your own phone or computer, follow your organization's bring your own device (BYOD) policy.

Laptops and phones on the move

The OPC's tips for workplace mobile devices include keeping only strictly necessary personal information on the device (de-identified where possible), using hard-to-guess passwords instead of factory settings, turning on automatic locking and using encryption. Never leave a device unattended in a public place or a vehicle. Report a lost or stolen device to your IT help desk right away.

Cloud services and file sharing

The OPC says an organization remains accountable for personal information it puts in the cloud, even with a free service. Cloud data may be stored in other countries, where it is subject to their laws and may be accessed by their courts or agencies. The OPC also warns that staff sometimes use cloud tools for customer data without IT knowing. Use only services your employer approves, and:

• Share with named people who need the file, not with "anyone with the link".
• Use multi-factor authentication on accounts that hold personal information.
• Remove access when a project ends or someone leaves the team.

Questionário temático 5: Remote work, devices and cloud services

Lesson 6: Privacy breaches: spot, contain and report

Under PIPEDA, a breach of security safeguards is the loss of, unauthorized access to or unauthorized disclosure of personal information, caused by a failure of safeguards or by not having them in the first place.

Employee snooping

Snooping is when staff look at personal information without authorization and without a legitimate business purpose, for example out of curiosity. To prevent it, the OPC says employers should limit access to what each role needs, keep access logs, audit them and tell staff these checks happen. Snooping can lead to discipline, a report to the OPC and notice to the people affected.

Your first steps

If you discover or cause a breach, report it right away to your supervisor or privacy officer, as your policy says. Do not hide it or investigate on your own. The OPC's tips for containing a breach include:

• Stop the source: reset passwords for a hacked account, disconnect affected systems, and change access codes for file rooms or cabinets.
• Tell those inside who need to know, such as the privacy officer, IT and legal, and write down what happened.
• Recover what you can: restore data from backups, ask a wrong recipient to delete or return information, and wipe a lost laptop remotely if possible.
• Preserve evidence. It helps find the cause and prevent the next breach.

Real risk of significant harm

Under PIPEDA, an organization must report a breach to the OPC and notify the people affected when it is reasonable to believe the breach creates a real risk of significant harm, whether one person or 1,000 people are affected.

Significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, a negative effect on a credit record, and damage to or loss of property. The two main factors are the sensitivity of the information and the probability it will be misused, such as who got it, whether there was malicious intent and whether it was encrypted.

Who must be told

Breach records

Organizations must keep a record of every breach of security safeguards, even ones without a real risk of significant harm, for two years (24 months). A record includes the date, what happened, the kind of information involved and whether the OPC and individuals were told. Knowingly breaking these rules is an offence that could lead to fines. When a service provider holds the information, the organization that gave it to them is generally responsible for reporting and records.

Alberta example

Under Alberta's Personal Information Protection Act (PIPA), an organization must notify Alberta's Information and Privacy Commissioner without unreasonable delay of a breach that creates a real risk of significant harm. It should notify even if its own investigation is not finished.

Questionário temático 6: Privacy breaches: spot, contain and report