Section 9: Respond to incidents and assess notification needs
In this section, you’ll learn to:
Responding to incidents and assessing notification needs
Even with good safeguards, mistakes, equipment failures and cyberattacks can happen. Preparing a response helps your nonprofit act promptly, protect people and continue essential work.
An incident-response plan explains who takes charge, whom to contact and what to do first. It can begin as a short document with a contact list and clear responsibilities. You do not need to investigate every problem yourselves, but you should know how to obtain help.
Know what needs reporting
An incident is an event that affects, or could affect, the security of your information, accounts, devices or services. Examples include:
Not every outage is a cyberattack, and not every incident involves personal information. Report concerns promptly so the appropriate person can assess them. Staff and volunteers should not have to prove that harm occurred before asking for help.
Prepare before you need the plan
Agree on the following arrangements:
|
Responsibility
|
What to establish
|
|---|---|
|
Coordinate the response |
A lead person and backup who can organize actions and obtain decisions |
|
Provide technical help |
Trusted provider contacts, support hours and emergency assistance arrangements |
|
Assess privacy and notification requirements |
A designated person who can seek appropriate privacy or legal advice |
|
Approve decisions and communications |
Who authorizes spending, service changes and messages to affected people |
|
Maintain essential services |
What must continue and how staff can work safely during a disruption |
Keep a protected copy of the plan and contact details available if your normal email or shared drive cannot be accessed. Include financial institutions, important providers and any insurer your organization uses.
Check which privacy requirements and contractual notification obligations apply before an incident occurs.
First response: report, limit harm and record
The right action depends on what happened. A misdirected email needs a different response from a potentially infected laptop.
Contact the response lead or backup. If email may be compromised, use another established channel.
Stop sending information, approving requests or interacting with the person involved.
With the response lead or provider, restrict exposed sharing, secure affected accounts or isolate an affected device.
Note times, affected accounts or files, actions taken and unresolved questions.
If a device appears infected, disconnect it from networks if you can do so safely and contact your trusted support provider. Avoid wiping, reinstalling or restarting it as an improvised fix; these actions can remove evidence. Canadian Centre for Cyber Security guidance emphasizes preserving evidence when responding to a compromised system.
If money has been sent fraudulently, contact the financial institution immediately through a trusted route. Do not wait for the wider assessment to finish.
A first-response script
Use this when receiving an incident report:
“Thank you for reporting this. Please stop the activity involved and keep the relevant message or information available. Tell me what happened, when you noticed it, which account, device or information was involved, and what you have already done. You do not need to know whether it was definitely an attack. We will coordinate the next steps.”
Ask for facts without blame. Prompt reporting can help limit harm; fear of embarrassment can delay it.
Do not ask someone to send passwords, sign-in codes or unnecessary copies of sensitive records as part of the report.
Preserve information without spreading it
Keep relevant messages, screenshots, provider notices and records of actions securely. Technical support may need original messages or system records to establish what happened.
Limit access to incident records. Describe affected information where possible rather than copying entire client files into an incident log. Record:
- When the event happened, if known, and when it was discovered.
- What information, accounts, devices or services may be affected.
- Who may have received or accessed information.
- Containment actions and who performed them.
- Advice received, decisions made and follow-up needed.
Distinguish confirmed facts from assumptions. Update the record as new information becomes available.
Decide whether personal information is involved
A privacy breach can involve lost personal information, unauthorized access or accidental disclosure. It does not require a hacker.
For example, emailing a participant list to the wrong person may require privacy assessment even if all your accounts remain secure.
Notification triage means identifying which requirements and contacts need attention. It is an initial assessment, not a substitute for the advice needed to make a difficult decision.
|
Question
|
What to establish
|
|---|---|
|
What information was involved? |
Types of information, sensitivity and the people affected |
|
What happened to it? |
Whether it was lost, accessed, copied, disclosed or made publicly available |
|
What harm could result? |
Risks to safety, finances, identity, reputation, relationships or access to services |
|
How likely is misuse? |
Who received or could access it, whether it was protected and what evidence is available |
|
What requirements apply? |
Relevant privacy laws, contracts, funder requirements and insurance conditions |
|
Who needs action or notification? |
Affected individuals, regulators, partners, providers or others who can help reduce harm |
Do not assume that a small number of affected people means low risk. One person’s exposed information could have serious consequences.
Understand the Canadian notification context
As discussed in Section 6, nonprofit status does not automatically determine which privacy law applies. PIPEDA may apply to commercial activities, while provincial or sector-specific requirements may also be relevant.
Where PIPEDA applies, a breach involving personal information under the organization’s control must be reported to the Office of the Privacy Commissioner of Canada, and affected individuals notified, when it creates a real risk of significant harm. Assessment considers the information’s sensitivity and the likelihood of misuse.
Required reporting and notification must occur as soon as feasible after determining that such a breach occurred. Records of all applicable breaches must be kept for at least two years, including breaches that do not meet the notification threshold.
Other requirements can have different thresholds or deadlines. Obtain appropriate advice promptly when applicability or notification is uncertain. Do not wait for a complete investigation before checking time-sensitive obligations.
The Privacy Commissioner’s breach guidance and risk assessment resources can support this assessment.
Communicate clearly and safely
When notifying people, explain what is known, what information is involved, what your organization is doing and what they can do to protect themselves. Provide a trusted contact for questions.
Meet the content and delivery requirements that apply. Avoid unsupported assurances such as “no one accessed the information” when that has not been established.
Choose a communication method that does not create another exposure. For example, a group email should not reveal the identities of affected clients, and a message to someone in a vulnerable situation needs careful consideration of a safe contact route.
Coordinate updates so staff give consistent, accurate information.
Restore safely and learn from the event
Before restoring files or returning to ordinary work, confirm with the appropriate support person that the cause has been addressed and access is safe.
Decide what needs recovery first, using the priorities and backup arrangements from earlier sections. Record temporary working arrangements and review them when normal services resume.
Afterwards ask:
- What helped us respond?
- What slowed us down?
- Which safeguard, instruction or agreement needs improvement?
- Who will complete that improvement, and by when?
Focus on changes that reduce the chance or impact of a recurrence.
A suggested policy rule
Actual or possible incidents must be reported promptly to the designated contact or backup. The response lead coordinates containment, evidence preservation, recovery and assessment of notification requirements. Decisions and actions must be recorded, required communications made promptly, and follow-up improvements assigned.
Before adopting this rule, name the contacts, decision-makers and sources of technical and privacy advice.
Practice your first response
Discuss this scenario: A volunteer reports that a spreadsheet containing client information was sent to an external recipient by mistake.
Do not assume that requesting deletion resolves the incident. Record the response and assess the circumstances.
Your takeaway
By the end of this section, you should have:
- A response lead, backup and trusted support contacts.
- A clear first-reporting process.
- A way to document incidents and assess notification needs.
- A plan for safe recovery and follow-up.
Next, you will bring these safeguards together to practice protecting your nonprofit from scams and fraud, even when a request appears familiar and believable.
Section 10: Protect your nonprofit from scams and fraud
This section builds on the safeguards you’ve learned to help protect your nonprofit’s information, accounts, and funds from cybercriminals who use deception to persuade people into taking unsafe actions.
English 
French 
Chinese 
Spanish 
Ukrainian 