“In the event of a privacy breach involving personal information, the professional must:

• Take reasonable measures to reduce the risk of harm to the individuals concerned by the breach and to prevent further breaches of a similar nature;
• Notify the CAI and the person concerned if the breach presents a risk of serious harm;
• Keep a record of incidents, a copy of which must be forwarded to the CAI at its request.