Do we have seventy-two hours to notify the Privacy Commissioner?

No. That figure comes from European law. The federal Canadian duty is to report as soon as feasible after you determine a breach has occurred, where it is reasonable to believe it creates a real risk of significant harm. Quebec's law asks for notice with diligence, which is how its French text reads (avec diligence). Its official English version says promptly. Both mean without delay. Neither law sets a day count, and both can be sooner than three days.

Should we tell customers before we know the full picture?

Usually you tell them when you know enough to say something true and useful. Draft the holding statement before the incident, so the delay on the day is about facts rather than about wording.

Incident response checklist: the first seventy-two hours

Q: Does calling the carrier's hotline count as notifying the insurer?

Not necessarily. One Canadian carrier says in its own published material, a service guide in its December 2020 edition, that its crisis hotline is for initial triage of an urgent event and does not satisfy the claim notification requirements of the policy. Read your own notice clause and write both steps into the plan as separate items, because they can be.

The first hour is about containment and starting the record. The first day is about scope, legal and the insurer. The first three days are about notification decisions and getting back to work. The technical response matters, but two other things are easy to miss: somebody writing things down from the first minute, and somebody knowing which calls have to happen before the others.

The first hour

Declare it. Somebody names an incident and sets a severity, so everyone else knows which plan they are in.
Start the decision log, with an owner whose only job is the log.
Contain what can be contained without destroying evidence, and record what you disconnected and when.
Call the person in your plan who can authorize spending and disconnection.
Check the notice clause in your cyber policy. Not act on it yet. Read it.

The first day

Establish scope: what systems, what data, how many people.
Engage legal, and where privilege matters, have counsel engage the forensics.
Give the insurer formal notice in the form your policy requires.
Agree a holding statement internally, even if nothing goes out.
Confirm whether the incident is a breach of security safeguards, because the record-keeping duty starts whether or not you notify anyone.

The first seventy-two hours

Make the notification decision, and record the reasoning whichever way it goes.
Notify the Privacy Commissioner if the threshold is met, then affected individuals.
Notify customers under contract, whose contracts may set a fixed clock the statute does not.
Start recovery sequencing: which operations come back first, and who decides.
Book the post-incident review before the room disperses.

What to record as you go

Record	Why
Every decision, with who made it and when	The part that is hard to reconstruct afterwards
What you knew at the time of each decision	Stops hindsight rewriting the timeline
Systems isolated, and the time	Regulator, insurer and forensics may all ask
Every external party contacted, and when	Evidence of timeliness
Costs as they are incurred	Your claim is built from this

Who has to be told, and in what order?

Your insurer may need to come first, depending on your policy’s notice clause. Read the clause carefully, because a carrier’s hotline and formal notice may not be the same thing. One Canadian carrier’s service guide, in its December 2020 edition, says plainly that its crisis hotline is intended for the initial triage of an urgent event, and does not satisfy the claim notification requirements of your policy (Chubb Canada, Cyber Services for Incident Response, Form 14-01-1244, 2020). The same document explains that response services come from a panel of Chubb pre-approved service providers, and is equally clear that a policyholder is under no obligation to contract for services with any of the Cyber Incident Response Team service providers (Chubb Canada, Cyber Services for Incident Response, Form 14-01-1244, 2020). Whether going outside a panel costs you anything is a question for your own policy wording rather than for that document. Find the answer before the day, not during it.

Then the regulators. Federally, the duty is to report where it is reasonable to believe the breach creates a real risk of significant harm to an individual, as soon as feasible after you determine it occurred (Personal Information Protection and Electronic Documents Act, subsection 10.1(1), 2018). In Quebec the trigger is the risk that serious harm will be caused, and notification is made with diligence (Loi sur la protection des renseignements personnels dans le secteur privé, P-39.1, article 3.5, 2022). Quebec publishes the law in French and in English. The French says avec diligence, which word for word is “with diligence”. The official English version says promptly (Act respecting the protection of personal information in the private sector, CQLR c P-39.1, section 3.5 (English version), 2022). Both mean without delay, and neither sets a number of days.

Then affected individuals, then customers whose contracts may set a fixed clock where the law sets none.

And keep the file. Every breach of security safeguards is recorded for 24 months, reportable or not (Breach of Security Safeguards Regulations, SOR/2018-64, section 6, 2018).

The order is the part to settle in advance. On the day, several people may start making calls at once, and the sequence they use will be whatever the plan told them, or whatever seemed sensible at the time.