Loblaw Signs OPC Compliance Letter After 2026 Data Breach

Loblaw Signs a PIPEDA Compliance Letter After a Breach Affecting Two Million Canadians

Loblaw Companies Limited signed a voluntary compliance letter with the Office of the Privacy Commissioner of Canada on October 21, 2026, after a cyberattack that the company says affected roughly two million Canadians. The letter is not an order, and Canada's federal privacy law attaches no fine to it.

Information last verified on October 29, 2026. This is a developing story; we update it as the record changes.

Status: The Commissioner-initiated investigation, file PIPEDA-054471, remains open as of October 29, 2026. Loblaw signed the compliance letter at Brampton, Ontario on October 21, 2026, and the OPC published the letter together with a news release on October 26, 2026. No report of findings under section 13 of PIPEDA has issued, and the letter states on its face that it is not an admission of liability.

Jurisdiction scope: This article covers Canadian federal private-sector privacy law, PIPEDA, as it applies to a breach at a commercial organization, and it names the provincial regimes that can displace it. It does not cover United States state breach-notification statutes, and it does not assess any individual's claim. For the underlying framework, see PIPEDA Explained.

What Happened

On October 26, 2026 the OPC announced that Loblaw had committed to strengthen its security measures following a cyberattack, and published the signed instrument itself. The instrument is titled a Compliance Letter to the Office of the Privacy Commissioner of Canada by Loblaw Companies Limited, and it is dated and signed at the City of Brampton, in the province of Ontario, on October 21, 2026.

The letter sets out the posture of the file. Under subsection 11(2) of PIPEDA the Commissioner launched a Commissioner-initiated investigation, file number PIPEDA-054471, into a breach of security safeguards that Loblaw announced on March 10, 2026. The letter states the investigation is examining the adequacy of two things: the security safeguards the organization had in place at the time of the breach, and its notifications to affected individuals. That second branch is easy to miss in the news coverage, and it is the one that drives the timing below.

The letter is explicit about how it came about:

"Loblaw has voluntarily agreed to fulfil the commitments set out in this Compliance Letter ... at the request of the Commissioner." Source: Compliance Letter to the OPC by Loblaw Companies Limited, General Terms (signed October 21, 2026)

The incident timeline, from the letter

The letter's Incident Overview sets out the facts as Loblaw confirmed them. Loblaw's investigation determined that the threat actor gained access by leveraging compromised credentials for a platform the company used for quality assurance activities, and that the earliest access was likely on February 23, 2026. Loblaw confirmed unauthorized access by criminal threat actors to certain of its systems on March 5, 2026, and took immediate containment steps with third-party cybersecurity experts.

On March 10, 2026, Loblaw posted a public advisory and a press release on its website and sent an in-app message to users of its PC Optimum application. It informed the OPC of the breach the same day and filed a preliminary report with additional detail on March 27, 2026.

The data categories deserve care. The OPC news release uses the general phrase customer account information. The letter is more specific: approximately two million Canadians had one or more of the following impacted, varying by individual, namely name, email address, postal address, phone number, date of birth, loyalty account number, purchase order details, incomplete payment card information such as the last four digits, and billing and shipping address. A footnote adds that other personal information was also impacted for a small number of affected individuals, approximately 300, who will receive tailored notification letters. Loblaw determined that the legal threshold for a real risk of significant harm under PIPEDA was met for the data listed.

The later dates are the ones that explain the timing of this announcement. At the OPC's request, Loblaw posted an updated public advisory on October 2, 2026. It provided the OPC with a copy of the notification letter to be sent to affected individuals on October 16, 2026, again at the OPC's request. Direct notifications, by email and mail as applicable, started on October 19, 2026, and Loblaw says it intends to complete delivery in the following weeks. Loblaw attributed the gap between March and October to an extensive data analysis, de-duplication and validation process needed to verify the scope of the breach and who it affected.

What Loblaw actually committed to

The Commitments part of the letter is short and dated. The headline item is an external security assessment. By October 31, 2027, Loblaw will give the Commissioner a confidential security assessment and report prepared by a reputable and independent external security assessment firm approved by the OPC, with that approval not to be unreasonably withheld. The report must describe the safeguard enhancements implemented since the breach, assess the effectiveness of current information security safeguards and associated training against widely accepted industry standard frameworks, and identify remaining gaps with recommended solutions. By November 30, 2027, Loblaw will tell the Commissioner in writing which recommendations it accepts, why it rejects any, and what it has implemented or plans to implement and when.

Three further commitments sit on tighter clocks. By November 16, 2026, Loblaw will confirm to the Commissioner that all affected individuals have been notified. By January 31, 2027, it will describe the data review, validation and de-duplication process used to decide who was affected, and separately describe its methodology for determining which affected individuals were subject to a real risk of significant harm. Quarterly progress updates begin three months after signing and continue until every commitment is met.

The letter also records what it does not do:

"This Letter is not intended as, or to be construed as, an admission of liability, fault or wrongdoing by Loblaw, or as a finding or reporting of finding by the Commissioner pursuant to section 13 of PIPEDA that Loblaw was or is in contravention of PIPEDA." Source: Compliance Letter to the OPC by Loblaw Companies Limited, General Terms (signed October 21, 2026)

Separately, and not to be confused with this file, the Commissioner announced on October 27, 2026 that he had opened a new investigation into Navigate360, the commercial organization that provides the tip management platform used by Canadian Crime Stoppers chapters. That is a different organization, a different breach, and no findings have been made.

What the Law Actually Says

PIPEDA applies to every organization in respect of personal information it collects, uses or discloses in the course of commercial activities, under paragraph 4(1)(a) of the Act. A national grocery and loyalty-program operator sits squarely inside that.

The obligation at the centre of this file is a principle, not a prescription. Clause 4.7 of Schedule 1 to PIPEDA, Principle 7, reads: personal information shall be protected by security safeguards appropriate to the sensitivity of the information. Clause 4.7.1 adds that the safeguards shall protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of format. Clause 4.7.2 scales the duty to sensitivity, amount, distribution, format and method of storage. Clause 4.7.3 names the methods, which include physical measures, organizational measures such as need-to-know access limits, and technological measures such as passwords and encryption. There is no statutory list of required controls, which is precisely why an OPC file like this one turns into a negotiation over an independent assessment rather than a citation for a missed technical standard.

The breach duties are harder-edged. Subsection 10.1(1) of PIPEDA requires an organization to report to the Commissioner any breach of security safeguards involving personal information under its control where it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. Subsection 10.1(3) requires the organization to notify the affected individual on the same trigger, and subsections 10.1(4) to (6) require the notification to contain enough information for the person to understand its significance and take steps to reduce or mitigate the risk, to be conspicuous, and to be given as soon as feasible after the organization determines the breach occurred. Subsection 10.1(7) defines significant harm to include humiliation, damage to reputation, financial loss, identity theft, negative effects on the credit record and loss of property. Subsection 10.1(8) lists the factors, which include the sensitivity of the information and the probability that it has been, is being or will be misused.

Subsection 10.2(1) then requires an organization that has notified an individual under subsection 10.1(3) to notify any other organization or government institution it believes may be able to reduce or mitigate the resulting harm. Subsection 10.3(1) requires the organization to keep and maintain a record of every breach of security safeguards involving personal information under its control, and subsection 10.3(2) requires it to give the Commissioner access to or a copy of that record on request.

Now the enforcement architecture, which is where this story lives. Subsection 11(1) lets an individual file a written complaint. Subsection 11(2) lets the Commissioner initiate a complaint where he is satisfied there are reasonable grounds to investigate, and that is the authority Loblaw's letter cites. During an investigation the Commissioner has real investigative muscle under subsection 12.1(1): he can summon and compel evidence on oath in the same manner and to the same extent as a superior court of record, enter premises other than a dwelling-house, and examine or copy records found there.

What he cannot do is decide the matter. Section 13 requires the Commissioner to prepare a report containing his findings and recommendations within one year after the complaint is filed or initiated. Recommendations are recommendations. The OPC states the limit plainly on its own guidance for complainants, which says the office cannot "issue fines or penalties" and cannot make an organization compensate an individual for a privacy breach.

Binding relief comes from the Federal Court. Section 14 lets a complainant apply to the Court for a hearing, after receiving the Commissioner's report or notice of a discontinuance, in respect of matters that include clause 4.7 of Schedule 1 and all of Division 1.1, the breach-reporting division. The application must be made within one year after the report or notification is sent, unless the Court allows longer. Subsection 14(3) states, for greater certainty, that this route applies in the same manner to complaints the Commissioner initiates under subsection 11(2). Section 15, by contrast, is expressly limited to complaints the Commissioner did not initiate; it is the provision that lets him apply to the Court with a complainant's consent, appear on a complainant's behalf, or appear as a party with leave.

Section 16 is the remedy section, and it belongs to the Court, not the regulator. The Court may order an organization to correct its practices to comply with Divisions 1 and 1.1, order it to publish a notice of action taken or proposed, and award damages to the complainant, including damages for any humiliation suffered. Our report on the Commissioner's Federal Court case involving Google shows what it looks like when a PIPEDA question actually reaches that forum.

PIPEDA does carry fines, but not for the thing most readers assume. Section 28 makes it an offence to knowingly contravene subsection 8(8), section 10.1, subsection 10.3(1) or subsection 27.1(1), or to obstruct the Commissioner, punishable on summary conviction by a fine of up to C$10,000 or as an indictable offence by a fine of up to C$100,000. That is an offence provision aimed at failing to report, failing to keep breach records, retaliating against a whistleblower or obstructing the regulator. It is not a penalty for inadequate safeguards, and it is prosecuted in the criminal courts, not imposed by the OPC.

The federal and provincial split

Canada does not have one private-sector privacy law. Paragraph 26(2)(b) of PIPEDA lets the Governor in Council exempt an organization, class of organizations or activity from PIPEDA where provincial legislation substantially similar to PIPEDA applies to it, for personal information collected, used or disclosed within that province. The OPC's own summary of privacy laws in Canada identifies Alberta, British Columbia and Quebec as the provinces with private-sector privacy laws that may apply in place of PIPEDA, and identifies Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia as having health privacy laws declared substantially similar with respect to health information. Our guides to the Alberta and British Columbia Personal Information Protection Acts and to Quebec's privacy overhaul under Law 25 set out how those regimes differ, including on penalty powers. So a sentence beginning "Canadian law requires" is almost always incomplete; the right question is which statute reaches the organization and the activity.

Reform is before Parliament but is not law. Bill C-36 in the first session of the 45th Parliament, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, received first reading on June 15, 2026 and sits at second reading in the House of Commons. It has not received Royal Assent. An earlier attempt, Bill C-27 in the first session of the 44th Parliament, which would have enacted the Consumer Privacy Protection Act, reached committee after second reading and never received Royal Assent. We track the current bill in our coverage of the PIPEDA replacement bill. Until one of these passes, the Act described above is the law that governs this file.

A Compliance Letter Is Not a Compliance Agreement

This distinction does most of the work in reading the Loblaw announcement accurately, and the documents do not line up the way the vocabulary suggests.

PIPEDA contains a named statutory instrument called a compliance agreement. Under subsection 17.1(1), where the Commissioner believes on reasonable grounds that an organization has committed, is about to commit or is likely to commit an act or omission that could contravene Division 1 or 1.1 or amount to a failure to follow a Schedule 1 recommendation, he may enter into a compliance agreement with that organization aimed at ensuring compliance. Subsection 17.1(2) lets the agreement contain any terms the Commissioner considers necessary. Subsection 17.1(3) is the trade: once an agreement is entered into, the Commissioner shall not apply to the Court for a hearing under subsection 14(1) or paragraph 15(a) on any matter the agreement covers, and shall apply to suspend any pending applications of his own. Subsection 17.1(4) preserves an individual's right to apply under section 14 and preserves prosecution of an offence. Subsection 17.2(2) supplies the teeth: if the Commissioner is of the opinion that the organization is not complying with the terms, he shall notify it and may apply to the Court for an order requiring compliance with the agreement, or for a hearing under subsection 14(1), or to reinstate suspended proceedings.

The Loblaw document is not that. It is styled a compliance letter, it is a letter from Loblaw to the Commissioner rather than a bilateral agreement, and its own General Terms identify the exit ramp as paragraph 12.2(1)(c) of PIPEDA. That paragraph lets the Commissioner discontinue an investigation where he is of the opinion that the organization has provided a fair and reasonable response to the complaint. Paragraph 12.2(1)(c.1), the separate ground for discontinuing where the matter is the object of a compliance agreement entered into under subsection 17.1(1), is not the ground the letter invokes. In other words, Loblaw's commitments are consideration for a discretionary discontinuance on the fair-and-reasonable-response ground, not terms of a statutory agreement enforceable under section 17.2.

That cuts both ways, and it is worth being accurate about which way.

Against the letter: there is no provision in PIPEDA that makes a compliance letter enforceable. If Loblaw misses the October 31, 2027 assessment deadline, the Commissioner cannot go to the Federal Court for an order requiring compliance with the letter, because section 17.2 attaches to agreements under subsection 17.1(1). What he can do is exactly what the letter says he can do: decline to be satisfied, continue the investigation, expand its scope under subsection 11(2), seek further commitments, and request information and documents to verify performance. The eventual backstop is the section 13 report of findings and recommendations, and after that the section 14 route to the Federal Court.

In favour of the letter: because it is not a subsection 17.1(1) agreement, it does not trigger the subsection 17.1(3) bar. A compliance agreement would have required the Commissioner to stand down from applying to the Court on any covered matter. The letter leaves that option on the table, and it says so in its own words, reserving that nothing in it shall prevent or otherwise limit the Commissioner from exercising or performing any of his powers and duties under the Act. The letter also says it may be disclosed or made public by the Commissioner under section 20 of PIPEDA, which at subsection 20(2) lets him make public any information that comes to his knowledge in the exercise of his duties where he considers it in the public interest. That publication power is why you can read the document at all, and publication is realistically a meaningful part of the pressure.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The OPC release frames voluntary compliance letters as part of the Commissioner's effort to resolve privacy issues more efficiently and expeditiously with companies that are motivated to improve their practices. Read alongside the Act, that framing describes a rational response to a structural constraint rather than a soft touch. Under PIPEDA as it stands, the slow, formal path is a one-year investigation, a report of non-binding recommendations, and then an application to the Federal Court. The fast path is to extract dated, specific, auditable commitments while the organization is still motivated, and keep the file open as leverage. Commissioner Dufresne's quoted statement in the release is consistent with that reading: "I am pleased that Loblaw has committed to undertake measures to improve privacy protections for Canadians, and taken steps to prevent future incidents."

The commitments themselves are better drafted than the usual regulatory promise to do better. Three features stand out. The external firm must be approved by the OPC, which forecloses a friendly vendor. The report must identify remaining gaps and recommend solutions, which means the deliverable cannot simply certify success. And the November 30, 2027 step requires Loblaw to state in writing which recommendations it declines and why, which converts a private consultant's findings into a record the regulator holds. Quarterly updates mean the file does not go quiet for a year.

The notification branch of the investigation deserves more attention than it has received. The Commissioner is examining the adequacy of the notifications, not only the safeguards, and the public record shows why. Loblaw's March 10, 2026 advisory described unauthorized access to some basic customer details, including names, phone numbers and email addresses, and said its investigation indicated that passwords, health information and credit card data were not compromised. Its updated advisory of October 2, 2026, posted at the OPC's request, described a materially longer list that added date of birth, loyalty account number, certain purchase order details and incomplete payment card information. Direct notification of individuals began on October 19, 2026, more than seven months after containment. Subsection 10.1(6) of PIPEDA requires individual notification as soon as feasible after the organization determines that the breach occurred, and Loblaw has committed to describe, by January 31, 2027, both the de-duplication process that consumed the interval and its methodology for deciding who faced a real risk of significant harm. Those two documents are where the notification question gets decided, and neither is public yet.

It is also worth naming what nobody has established. There is no finding that Loblaw contravened PIPEDA, the letter disclaims any admission of liability, and the Commissioner has made no report under section 13. Clause 4.7 frames the safeguards question as appropriateness relative to the sensitivity of the information rather than compliance with a fixed checklist, so the independent assessment is doing real analytical work and not merely confirming a conclusion.

The wider point for readers outside Canada is comparative. A breach of this size in a jurisdiction with administrative monetary penalties would be discussed in terms of exposure. Here the discussion is about whether a regulator will be satisfied, because the enforcement currency is satisfaction, publication and the possibility of litigation by someone else. Whether that is adequate is a question now sitting before Parliament in Bill C-36, which has not passed.

How This Affects You

General information only, and none of it is advice about a particular situation.

If you were among the roughly two million people Loblaw identified as affected, the notification duty runs to you directly. Subsection 10.1(3) of PIPEDA requires an organization to notify an individual of a breach involving that person's information where it is reasonable to believe the breach creates a real risk of significant harm, and subsection 10.1(4) requires the notice to contain enough information for you to understand the significance of the breach and take steps to reduce or mitigate the harm. Loblaw began sending those notices on October 19, 2026 by email and mail, and has told the Commissioner it will confirm by November 16, 2026 that notification is complete. Loblaw's own public notice says the individual notice sets out which types of information about that customer were involved and explains how to access complimentary credit monitoring and identity theft protection services. Treat an unexpected message about the breach with suspicion; the OPC's identity theft guidance advises confirming that an organization contacting you is legitimate before taking any other action.

If you have a privacy concern about an organization, the OPC's published process is to raise it with the organization first, because the office says it may not be able to accept a complaint if you have not. After that, subsection 11(1) of PIPEDA lets you file a written complaint with the Commissioner against an organization for contravening Division 1 or 1.1, or for not following a Schedule 1 recommendation. The OPC currently warns of processing delays of several months. If you are not satisfied with the outcome, section 14 lets you apply to the Federal Court for a hearing within one year after the Commissioner's report or a notice of discontinuance is sent, and section 16 is the provision under which the Court may order corrected practices or award damages, including damages for humiliation. Note what a compliance letter does not take away: it is not a subsection 17.1(1) agreement, and even a subsection 17.1(1) agreement expressly preserves an individual's right to apply under section 14.

On the fraud side, the OPC's identity theft guidance sets out the practical steps: change passwords for affected online accounts, tell your bank and card issuers and ask for new card numbers, report a theft or crime to local police, report scams and fraud to the Canadian Anti-Fraud Centre, replace any missing identity documents through the issuing body, contact the Canada Revenue Agency if you believe your tax account is exposed, and monitor your credit by ordering a credit report and score or subscribing to credit alerts. Loblaw's own notice says the credit monitoring and identity theft protection it is offering to notified individuals is provided through TransUnion, and that it is contacting affected individuals through Cyberscout, a division of TransUnion. The Canadian Anti-Fraud Centre takes reports online through its fraud and cybercrime reporting system at reportcyberandfraud.canada.ca, and by phone toll free at 1-888-495-8501, a line its reporting page says is answered Monday to Friday from 10 a.m. to 4:45 p.m. Eastern and closed on holidays.

Finally, check which law reaches the organization you are dealing with. PIPEDA governs commercial activity federally, but paragraph 26(2)(b) allows provincial substitution, and the OPC identifies Alberta, British Columbia and Quebec as having private-sector statutes that may apply instead. A complaint sent to the wrong regulator is a lost month.

This is general legal information, not legal advice. It covers Canadian federal private-sector privacy law and names the Alberta, British Columbia and Quebec private-sector regimes, and it reflects sources verified on October 29, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• PIPEDA and Canada's data privacy laws, explained end to end
• Canada's first children's privacy code and what the OPC guidance says
• Federal and provincial law across Canada

---

Last updated: 2026-10-29. This is a developing story; details verified as of 2026-10-29.

Frequently Asked Questions

Is a compliance letter the same as a fine?

No. A compliance letter is a voluntary commitment. The Privacy Commissioner of Canada has no power under PIPEDA to impose a fine or an administrative monetary penalty, and the OPC's own guidance for complainants states that the office cannot issue fines or penalties and cannot make an organization compensate an individual for a privacy breach. PIPEDA's only fines sit in section 28, which creates a prosecutable offence for knowingly failing to report a breach under section 10.1, failing to keep breach records under subsection 10.3(1), retaliating against a whistleblower or obstructing the Commissioner, with a maximum of C$10,000 on summary conviction and C$100,000 on indictment.

What happens if Loblaw misses one of the deadlines in the letter?

The letter is not enforceable as a court order and it is not a compliance agreement under section 17.1 of PIPEDA, so section 17.2, which lets the Commissioner ask the Federal Court to order compliance with an agreement, does not apply to it. By its own terms, the Commissioner can decline to be satisfied, continue the Commissioner-initiated investigation, expand its scope under subsection 11(2), request information and documents to verify performance, and seek further commitments. The formal end point is a report of findings and recommendations under section 13, after which the Federal Court route under sections 14 to 16 becomes available.

What personal information was involved?

The compliance letter states that approximately two million Canadians had one or more of the following affected, varying by individual: name, email address, postal address, phone number, date of birth, loyalty account number, purchase order details, incomplete payment card information such as the last four digits, and billing and shipping address. A footnote adds that approximately 300 individuals had other personal information affected and will receive tailored notification letters. The OPC news release describes it more generally as customer account information.

Why did it take until October 2026 to notify individuals about a February 2026 breach?

Loblaw told the OPC that the timing was due to an extensive data analysis, de-duplication and validation process undertaken to verify the scope of the breach and who it affected. The adequacy of the notifications is one of the two issues the Commissioner's investigation is examining, and Loblaw has committed to describe that process, and its methodology for deciding who faced a real risk of significant harm, to the Commissioner by January 31, 2027. Subsection 10.1(6) of PIPEDA requires individual notification as soon as feasible after the organization determines that the breach occurred.

Can an affected person sue over a PIPEDA breach?

PIPEDA does not create a general damages claim that starts in court. Section 14 lets a complainant apply to the Federal Court for a hearing only after receiving the Commissioner's report or a notice that the investigation was discontinued, and only on matters listed in that section, which include the safeguards clause 4.7 of Schedule 1 and all of Division 1.1. The application must be filed within one year after the report or notice is sent unless the Court allows longer. Section 16 is the remedy provision: the Court may order an organization to correct its practices, order it to publish a notice of action taken, and award damages including damages for humiliation. Claims brought outside PIPEDA, such as provincial class proceedings, run under separate rules that this article does not address.

Does this involve any other OPC investigation?

The Commissioner announced a separate investigation on October 27, 2026 into Navigate360, the commercial organization that provides the tip management platform used by Canadian Crime Stoppers chapters. It is a different organization and a different incident, and no findings have been made in it. The OPC noted in that release that PIPEDA generally does not apply to not-for-profit organizations, and that Crime Stoppers is a not-for-profit.

Does PIPEDA apply everywhere in Canada?

Not uniformly. PIPEDA applies to organizations in respect of personal information collected, used or disclosed in the course of commercial activities under paragraph 4(1)(a), but paragraph 26(2)(b) lets the Governor in Council exempt organizations and activities from PIPEDA where substantially similar provincial legislation applies within that province. The OPC identifies Alberta, British Columbia and Quebec as having private-sector privacy laws that may apply instead, and identifies Ontario, New Brunswick, Newfoundland and Labrador and Nova Scotia as having health privacy laws declared substantially similar with respect to health information.