Knowing what to do after a data breach is less about technical brilliance than getting the first decisions in the right order. It’s 8:12 on a Tuesday morning, and an employee notices something odd in Microsoft 365. A folder containing client documents appears to have been opened overnight.
Nobody knows by whom.
The IT provider can’t yet say whether it was a mistake or an intrusion. The owner is left with three questions:
“What happened? What was accessed? What do we do now?”
Table of Contents
Getting the first decisions in the right order changes everything.
Preserve the Evidence. Contain the Access.
The instinct is to act immediately. Delete the suspicious files. Restart the computer. Wipe the laptop. Change everything.
But some of those actions can erase the trail needed to understand what happened. At the same time, you cannot leave a compromised account open simply because an investigation is underway.
The distinction matters — and it is the first thing to understand about what to do after a data breach: preserve what can help explain the incident while containing access that could allow it to continue.
Record when the problem was discovered, which accounts and devices may be involved, who had access, and what information might be exposed. The Office of the Privacy Commissioner of Canada’s guide to containing a privacy breach provides a useful framework for this stage.
CA$7.11 million
the average cost of a data breach for Canadian organizations in 2026 — a record high, according to IBM’s Cost of a Data Breach Report.
Source: IBM Canada, 2026
Then Stop the Bleeding
By 9:00, the question has changed from What happened? to How do we stop it? This is the second half of what to do after a data breach — containment.
Affected devices may need to be isolated. Suspicious sessions terminated. Compromised credentials reset. Access restricted.
The goal isn’t to solve the entire incident in an hour. It’s to prevent a bad morning from becoming a much worse week.
This is where preparation makes a difference. A business should already know who leads an incident, who contacts the IT provider, who involves legal or privacy counsel, and who communicates with employees or customers. Without those decisions made in advance, valuable time can disappear into one uncomfortable question: Who is supposed to handle this?
Preserve what explains the incident. Contain what allows it to continue.
What Was Actually Exposed?
By lunchtime, the most important question may no longer be technical. It may be whose information was involved.
A compromised laptop is one problem. A compromised laptop containing patient records, tax information, or confidential client files is another.
The business needs to establish which systems and information were accessed, how far the incident may have gone, and who could be affected. This is where the earlier work on business cybersecurity risk in 2026 pays off — the same access mapping that prevents breaches also clarifies what was exposed. Knowing this early shapes every other decision you make about what to do after a data breach.
Meet Your PIPEDA Obligations
For organizations subject to PIPEDA, a breach involving personal information must be reported to the Office of the Privacy Commissioner of Canada when it is reasonable to believe it creates a real risk of significant harm.
Affected individuals may also need to be notified, and organizations must keep records of breaches. The OPC’s breach reporting page provides guidance and an online reporting process.
A cyber incident can quickly become a business, privacy, and reputation problem at the same time — which is why the legal side of what to do after a data breach cannot wait until the technical side is fully resolved.
A compromised laptop is one problem. What it held is another.
Recovery Isn’t the Same as Resolution
By the next morning, everyone wants the systems back. But working computers don’t necessarily mean the incident is over.
You can restore files while an attacker still has access to an account. You can reset a password without discovering how it was stolen. You can get the business running again without fixing the weakness that allowed the intrusion.
Recovery gets the business moving. Investigation tells you whether it is safe to keep moving.
This distinction is closely tied to the same habits that prevent human error in cybersecurity from becoming a recurring incident — including how credentials are managed and how access is reviewed after a breach. It is also where many businesses get what to do after a data breach wrong: they mistake an empty inbox for a closed case.
Be Ready Before You Need To
The businesses that handle incidents well aren’t necessarily the ones that never experience them. They’re the ones that already know what happens when something goes wrong.
At RytPik, we help businesses identify critical accounts, systems, and access points, then build a clearer response around them — before the pressure of a real incident begins.
Because the real answer to what to do after a data breach starts long before the breach happens. Cybersecurity isn’t only about keeping attackers out. It’s being ready when one gets through.
Related reading: 2026 cyber insurance requirements every small business must have before renewal →
An incident response plan is not a document you write during the incident.
Incident response planning is preparation, not improvisation.
Frequently Asked Questions
Q: What should a business do immediately after discovering a cyberattack?
Document what was found, preserve relevant evidence, contain compromised accounts or devices, and contact your IT or cybersecurity provider. Avoid wiping or reimaging affected systems before the situation is understood. For a full framework, see the OPC’s guide to containing a privacy breach →
Q: Does every data breach have to be reported in Canada?
No. Under PIPEDA, reporting and notification requirements depend on whether the breach creates a real risk of significant harm. Other Canadian privacy laws may apply depending on the organization and circumstances. Review the OPC’s breach reporting guidance →
Q: How long should a business keep breach records?
Organizations subject to PIPEDA must retain records of breaches involving personal information for at least 24 months. Read about 5 cybersecurity mistakes small businesses make →
Q: Can a business recover without an incident response plan?
Yes, but the response can be slower and less coordinated. A written plan establishes responsibilities before the pressure of a real incident begins — and it is one of the clearest answers to what to do after a data breach. Read our guide on business cybersecurity risk in 2026 →
Q: How much does a data breach cost a Canadian business?
IBM’s 2026 Cost of a Data Breach Report put the average at CA$7.11 million per breach for Canadian organizations — a record high for Canada. See the IBM Canada report →
Q: Does breach readiness affect cyber insurance eligibility?
Yes. Insurers increasingly ask for documented incident response plans and reporting procedures before underwriting. Read our guide on 2026 cyber insurance requirements →
The First Hour Matters Most
What happens in the first hour after a breach often shapes everything that follows — the cost, the investigation, the client relationship, the recovery.
The businesses that handle it well are not the ones who react fastest. They are the ones who already knew what to do.
RytPik — Advanced Cybersecurity. Trusted Protection. Business Confidence.
Explore more RytPik resources:
