In short: IBM puts the average cost of a data breach in Canada at 7.11 million dollars in 2026. That figure does not describe an SMB. For small businesses, Statistics Canada cannot publish a single one of the sixteen recovery cost items for 2025: the responses are too unreliable. What the data does show is that an incident in a small business is paid mostly in time and service outages, not in ransoms: 84% of affected businesses paid no ransom at all. And the Law 25 obligations, the register and the notices, apply with or without an insurance policy.
Disclaimer: this text explains a legal framework in plain language, without being legal advice. The sections, ceilings and obligations cited come from the Act respecting the protection of personal information in the private sector and from the publications of the Commission d'accès à l'information. The cost figures come from Statistics Canada and IBM, and the worked example rests on assumptions, not on a market survey. The exact scope of an obligation in your organization is something to confirm with legal counsel.
In this article
- Who this calculation is for, and who it is not for: three closed questions that decide whether the rest is useful, one of them sending you elsewhere.
- Why the 7.11 million figure is not yours: IBM's average rests on 602 organizations and 28,500 compromised records per incident.
- The cost items Statistics Canada cannot price: not one of the sixteen cost items is publishable for small businesses in 2025.
- What an incident actually does to a small business: 46.2% of incidents stay minor, and the bill is mostly made of extra time.
- The obligations that do not depend on your policy: assess, notify, log in the register, three Law 25 steps no insurer performs for you.
- The penalties, and the conditions attached to them: a 10 million ceiling, yet 0.7% of affected small businesses reported a fine.
- What a policy would have absorbed, and what stays with you: 34% of businesses carry insurance and 6% of insured affected ones filed a claim.
- Pricing your own incident in an hour: five lines and a worked example at 12,200 dollars, with no ransom or penalty.
- The blind spots in this calculation: the survey starts at ten employees, the data is Canadian, and averages hide their tail.
- At Blue Fox: the register, the notification procedure and backups whose restoration has been tested.
7.11 million dollars. That is the average cost of a data breach in Canada in 2026, according to IBM's annual report published on July 29. The number will circulate all autumn in vendor newsletters and sales decks.
It probably does not apply to you. Not because it is wrong, but because it measures something other than what happens to a twenty-person organization. And when you go looking for the figure that would describe an SMB, you hit a void: the national statistical agency cannot publish one.
Here is what is established, what is not, and how to calculate your own exposure instead.
Who this calculation is for, and who it is not for
Three closed questions before going further. They decide whether the rest is useful to you.
Do you hold personal information about customers, members, beneficiaries or employees? If so, half of this article covers legal obligations that apply directly to you. If not, only the business interruption part concerns you, and you can skip the Law 25 section.
Do you already hold a cyber insurance policy? If so, your question is not "what does it cost" but "what would be refused". That one is covered elsewhere, in our article on what cyber insurance covers and what it does not.
Does your organization have fewer than ten employees? The benchmarks here do not cover you: the Statistics Canada survey starts at ten employees. The calculation method at the end still holds, the percentages do not.
Why the 7.11 million figure is not yours
The IBM Canada release of July 29, 2026 announces a record high: 7.11 million Canadian dollars on average per data breach in Canada. Energy leads at 9.21 million, technology at 9.02 million, industrial at 8.89 million. The average breach lifecycle reaches 205 days, up 6% year over year.
Two details in that same release explain why this is not your bill.
The first: the study covers 602 organizations worldwide that suffered a breach between March 2025 and February 2026, and the release does not say how many of them are Canadian. The second: the average number of compromised records per incident is 28,500. An average built on breaches of that size tells you nothing about an incident touching 300 customer records.
One figure in the report does stay useful to an SMB, though: a supply chain compromise adds an average of 367,899 dollars to the cost of an incident. What matters there is the direction, not the amount. Your exposure runs through the access you have granted to third parties.
The cost items Statistics Canada cannot price
The agency publishes a table built to answer exactly our question: the average cost to recover from cyber security incidents, split into sixteen items, broken down by business size, and calculated on affected businesses only. Salaries spent on recovery, IT consultants, legal and public relations services, software, hardware, reimbursements to customers, Canadian and foreign fines, ransom payments, credit monitoring, breach notification costs.
For small businesses, those with 10 to 49 employees, not one of the sixteen items has a publishable value for 2025. Not a single one. Every cell carries quality indicator F, which in the agency's own vocabulary means "too unreliable to be published".
What survives at the level of the whole private sector is thin, and the agency itself flags it "use with caution": 2,749 dollars on average to hire IT consultants or contractors, 1,259 dollars in new or upgraded software, 691 dollars in hardware. Among large businesses, the consultant item rises to 7,045 dollars.
That void does not mean it costs nothing. It means too few affected small businesses answer those questions for an average to hold up. A related signal from the same survey: 18% of small businesses affected in 2025 answered that they did not know what the impacts of the incident had been.
The practical consequence is usable right away: nobody can sell you a credible average cost for your size. If a vendor shows you one, ask for the source and the business size it applies to.
What an incident actually does to a small business
The neighbouring table does hold up. It gives the reported impacts, as a percentage of affected businesses. Here is 2025 for small private sector businesses.
| Reported impact | Small businesses affected |
|---|---|
| Minor incident, minimal impact on the business | 46.2% |
| Additional time needed for employees to do their work | 21.9% |
| Resources or services unavailable | 17.3% |
| Loss of revenue | 16.1% |
| Additional repair or recovery costs | 11.9% |
| Employees prevented from carrying out day-to-day work | 11.8% |
| Damage to the integrity of software or hardware | 7.9% |
| Duty to inform external parties of the breach | 7.9% |
| Damage to reputation or erosion of public trust | 7.7% |
| Manipulation or theft of data or intellectual property | 3.4% |
| Loss of suppliers, customers or partners | 2.8% |
| Penalties or fines from Canadian authorities | 0.7% |
| The business does not know what the impacts were | 18.0% |
Two readings stand out. The first: the most frequent outcome is a minor incident, and close to half of affected small businesses classify it that way. The second: when there is a bill, it is made of time. The most reported item after minor incidents is the extra time paid to catch up on work, followed by resource unavailability and lost revenue.
Ransom, for its part, is marginal in both directions. In 2025, 8% of affected businesses reported ransomware, a sharp drop after 11% in 2021 and 13% in 2023. And among affected businesses, more than four in five, 84%, paid no ransom. The movie scenario is not the common scenario.
One last figure, which says something about what executives do with their incidents: 11% of affected businesses reported them to a police service in 2025, down from 13% in 2023.
The obligations that do not depend on your policy
Quebec adds a layer here that insurance does not replace. The Act respecting the protection of personal information in the private sector imposes three distinct steps on any business holding personal information, and none of the three can be delegated to an insurer.
Assess. Section 3.7 requires considering the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used for harmful purposes, then consulting your privacy officer.
Notify, if the incident presents a risk of serious injury. Section 3.5 requires notifying the Commission d'accès à l'information with diligence, and notifying every person whose information is involved. Failing that, the Commission can order it.
Keep a register. Section 3.8 imposes it unconditionally and the Commission can request a copy. Its January 2026 guide leaves no room for interpretation: you must keep a register and record in it every confidentiality incident, whether or not the risk of injury is serious.
This is the point most often missed. The register does not start at the first serious incident, it starts at the first incident, period. An email sent to the wrong person belongs in it.
These three steps are paid in hours, and they are your hours or your lawyer's. The volume shows the mechanism is working: in its 2024-2025 annual report, the Commission says it received 514 confidentiality incident notices, up 16% in one year and 559% over three years. Four in five, 80%, came from the private sector. On causes, it writes that the most frequent causes of reported confidentiality incidents are cyberattacks, human error and ransomware. Human error ranks alongside attack, which changes entirely what you should be spending protection money on.
The register and the notification procedure take a few hours to set up, before the incident, and they are the cheapest part of this whole file. We install the register where your data already lives, with the notice templates and the list of people to reach. For the full framework, see our review of Law 25 four years on.
The penalties, and the conditions attached to them
The ceilings are spectacular and they have to be read with their conditions, otherwise they only serve to frighten.
The administrative monetary penalty can reach 10 million dollars or 2% of worldwide turnover for the preceding fiscal year, whichever is higher, for a business, and 50,000 dollars for a natural person. Failing to report an incident to the Commission or to the people concerned, when required to do so, appears explicitly in the list of covered failures.
On the penal side, the fine runs from 15,000 dollars to 25 million, or 4% of worldwide turnover. On the civil side, section 93.1 provides for punitive damages of at least 1,000 dollars, but only where the unlawful infringement of a right conferred by the Act is intentional or results from gross fault. In a class action, that floor is multiplied by the number of people involved.
Now the counterweight, and it matters as much as the ceilings: in 2025, 0.7% of affected small businesses reported a financial penalty or a fine from a Canadian authority. The maximum amounts are real, their application stays rare. These are not sums to provision for, they are sums not to trigger.
What gets checked first, in practice, is the register and the notices.
What a policy would have absorbed, and what stays with you
In 2025, more than a third of Canadian businesses, 34%, reported holding cyber risk insurance. Adoption is climbing fast: 16% in 2021, 22% in 2023. Among large businesses it reaches 63%.
The surprising figure is elsewhere. Among businesses both insured and affected by an incident in 2025, 6% attempted to make a claim. Six percent. And the proportion went down, it was 9% in 2023, while insurance adoption was going up.
Two explanations hold together: most incidents stay under the deductible, and eligibility conditions have tightened. That is the subject of our article on cyber insurance, which details what insurers now require before they pay.
What a policy absorbs, when the claim goes through: the technical response, business interruption losses, legal fees, the notices. What it never absorbs: the serious injury assessment, keeping the register, the conversation with your customers, and the time your employees spend redoing lost work. Those items are yours in every scenario.
Pricing your own incident in an hour
Five lines are enough. The exercise is only worth your own numbers, so replace every rate with yours.
The five lines to fill in, in this order:
- Internal time: who stops working, for how many hours, at what loaded hourly rate.
- Outside help: an emergency hourly rate, obtained before you need it.
- Interruption: days of downtime multiplied by your daily margin, not by your daily revenue.
- Notices: the legal hours of the assessment, plus the number of people to reach.
- Emergency replacement: the hardware and licences you have to buy back quickly.
An illustrative example, with the assumptions laid out in plain sight: an organization of 18 people, an average loaded hourly rate of 45 dollars, a partial two-day outage, a daily margin of 1,400 dollars, and 420 people to notify.
| Line | Assumption | Amount |
|---|---|---|
| Internal time | 6 people idled for 11 hours at 45 dollars | 2,970 dollars |
| Outside help | 20 hours at 150 dollars | 3,000 dollars |
| Interruption | 2 days at half the daily margin | 1,400 dollars |
| Notices and assessment | 6 legal hours at 300 dollars, plus 420 mailings at 1.50 | 2,430 dollars |
| Emergency replacement | Two workstations and their licences | 2,400 dollars |
| Total | No ransom, no penalty, no customer loss | 12,200 dollars |
Twelve thousand dollars. That amount makes the headline of no annual report, and it cuts into an SMB budget for a quarter. It is also an order of magnitude you can defend in front of a board, which 7.11 million does not let you do.
The result feeds two decisions: what you provision for, and whether an insurance premium is worth its price for you.
The blind spots in this calculation
Several limits, better named than hidden.
The survey cited starts at ten employees and excludes public administration. A six-person business does not appear in it, and that is a large share of the Quebec economic fabric.
The tables are Canadian, not Quebec-specific. The ones we cite are broken down only by industry and size, never by province. The legal obligations, on the other hand, are very much Quebec ones.
Averages hide their tail. One incident in a hundred costs far more than the average, and that is precisely the one you insure against.
A suppression for reliability is not a zero. That the agency does not publish the average cost of legal services for small businesses says nothing about that cost, other than that few businesses reported it.
And assessing the risk of serious injury is done file by file, with your privacy officer, never from an article.
At Blue Fox
The cheapest part of this file is prepared before the incident, and it is not technical. An incident register that lives where the data already lives, in the management tool rather than in a file nobody will find again. A notification procedure written in advance, with its templates. Backups whose restoration has been tested, not just scheduled.
Two other pieces reduce the number of incidents to record, and they cost less than everything else: a password manager and an access transfer plan, the one covered in our article on passing on login information. Since human error ranks alongside cyberattack in the notices the Commission receives, that is where the dollar works hardest.
We deploy these things on libre infrastructure, hosted in Quebec and under the client's control. It does not bring the risk to zero, and no vendor should promise you that.
If you want to put a number on your real exposure before talking to a broker, let's talk about your situation.
Sources
- Statistics Canada, "Impact of cybercrime on Canadian businesses, 2025": the October 21, 2026 release, source of the affected business rates, insurance, ransoms and police reporting.
- Statistics Canada, table 22-10-0132-01: average cost to recover from cyber security incidents by industry and size of enterprise, with its quality indicators.
- Statistics Canada, table 22-10-0133-01: impacts of cyber security incidents on businesses, source of the small business table.
- IBM Canada, news release of July 29, 2026: the Canadian average of 7.11 million, the sectors, the breach lifecycle and the Ponemon methodology.
- Act respecting the protection of personal information in the private sector: sections 3.5 to 3.8 on incidents and the register, 90.12 and 91 on penalties, 93.1 on punitive damages.
- Commission d'accès à l'information, « Prévenir les incidents de confidentialité »: the January 2026 guide, French only, including the rule that the register covers every incident.
- Commission d'accès à l'information, 2024-2025 annual report: the 514 incident notices received, their breakdown and the most frequent causes.