Build a Customer Remedy Plan Before a Data Breach

Matthew Leo · Published October 31, 2026 · Guides

A customer-service manager and privacy adviser review an incident-response checklist in an illustrative Canadian office.

A breach notice tells customers what happened. A remedy plan tells them what the organization will do about the harm, cost and disruption that follow.

Two Japanese companies recently made that distinction visible. GMO Internet Group said current service customers would receive a ¥5,000 goodwill payment after a cyberattack, separate from compensation for verified unauthorized transaction losses. Park24 said eligible customers affected by the exposure of encrypted identity-document images would receive ¥3,000 in cash or gift value. Park24 also said it would stop retaining those images after verification.

These are company-specific responses under Japanese circumstances, not a pricing guide for Canada. They are useful because they separate several obligations that organizations often collapse into one vague offer of support.

Start with the Canadian legal baseline

Under federal private-sector privacy law, an organization subject to PIPEDA must report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals when the incident creates a real risk of significant harm. It must also keep a record of every breach of security safeguards for two years, including incidents below the reporting threshold.

The OPC’s containment guidance recommends documenting what happened, preserving evidence, assessing risk, recovering data and designating a lead investigator. Its risk-assessment tool focuses on the sensitivity of the information and the probability of misuse.

A payment does not replace those duties. Nor does notification automatically settle a customer’s financial loss. Organizations should obtain advice for the provinces, industries and contracts that apply to them.

Separate five kinds of response

1. Containment and correction

Stop unauthorized access, preserve evidence and fix the control that failed. If the business retained information longer than it needed, change the retention process. Park24’s decision to stop holding identity images after verification is a corrective measure, not customer compensation.

2. Direct-loss reimbursement

Create a route for customers to claim verified costs caused by the incident. Examples may include an unauthorized transaction, a replacement identity document or a reasonable service fee required to restore access. Define evidence requirements without asking customers to resubmit sensitive information unnecessarily.

Customers who see an unfamiliar charge still need to act quickly. Mapletechie’s guide to disputing an unauthorized bank transaction in Canada covers the immediate steps.

3. Risk-reduction services

Credit monitoring, identity-restoration help, account protection or an alternative service can reduce future risk. Match the service to the data involved. Credit monitoring may be relevant to financial identifiers but less useful for the exposure of a work email address.

4. Goodwill

A fixed payment, bill credit or service extension recognizes disruption even when a customer cannot prove a specific dollar loss. Keep it separate from direct-loss reimbursement so accepting a small goodwill payment does not create confusion about larger documented losses.

5. Clear communication

Explain who qualifies, what the remedy covers, how to apply, the deadline, expected processing time and appeal route. State whether the offer affects other rights. Avoid language that implies the incident is harmless merely because some data was encrypted; future decryption or stolen credentials may change the risk.

Decide eligibility before the crisis

A workable policy identifies the people and services in scope. Use facts from the incident, not only the current customer list. Former customers, applicants or authorized users may be affected even if they no longer pay the company.

For each remedy, define:

Do not distribute compensation through an unsolicited link that trains customers to trust phishing messages. Direct people to a known website or app, publish a verified telephone number and explain what information the organization will never request.

A decision framework for the amount

There is no universal number. Begin with the likely costs a reasonable customer may incur, the sensitivity and duration of exposure, the number of people affected, the availability of substitute services and the organization’s ability to process claims fairly.

A flat payment is simple but imprecise. Reimbursement is more tailored but creates paperwork and can exclude people who cannot document their time or disruption. Many incidents need both: a modest automatic remedy for a defined group and a separate route for larger verified losses.

Before announcing either, test the process with customer support, privacy, legal, security, finance and fraud teams. An insurer or payment provider may impose notice, consent or documentation conditions.

Build the customer-facing package

The finished package should contain a plain-language incident notice, a remedy summary, a secure claim path, fraud warnings, contact details and an update page with a visible revision date. Keep the technical investigation and the claim decision connected: new findings may expand the eligible group or extend the deadline.

Customers need practical actions too. Mapletechie’s Canadian data-breach notice checklist explains password, account and credit-protection steps that can accompany the notice.

The strongest remedy plans acknowledge uncertainty without becoming vague. State what is confirmed, what is still being investigated and when the next update will arrive.

Sources: GMO Internet Group response; Park24 response; Reuters reporting; OPC mandatory-breach guidance.

Tags: data breach, consumer protection, privacy, incident management

Read on Mapletechie