The 60-second summary
On 14 October 2026, the OPC closed its WestJet investigation after the company demonstrated that its commitments were met. The response included stronger identity safeguards and an independent assessment. The July compliance letter describes social engineering of a privileged account and requires evidence on remaining gaps and recommendations. It expressly is not an admission or formal finding of contravention.
Timeline that matters
12 June 2025
8 July 2026
14 October 2026
24 October 2026
What changed
The OPC has announced completion of the commitment-based investigation process.The outcome offers an evidence model for reviewing remediation without implying a universal compliance certification.
Who should care
Organisations recovering from serious data incidentsIdentity and service-desk ownersPrivacy and security leadershipIndependent assurance and supplier-risk teams
Why this matters for global organisations.
Post-breach assurance needs evidence that controls work, not only that projects finished. Test identity recovery, assess safeguards independently and keep a traceable response to every recommendation.
13 actions to start now
- Map privileged identities and recovery routes across critical systems.
- Review identity-verification controls for credential and MFA resets.
- Test social-engineering resistance through authorised exercises.
- Record controlled exceptions and compensating safeguards.
- Review privileges against current operational needs.
- Map sensitive data and trust relationships relevant to incident scope.
- Define evidence requirements for each remediation commitment.
- Commission appropriately independent validation of material controls.
- Separate completed implementation from demonstrated effectiveness.
- Track accepted recommendations and justified alternatives.
- Assign owners and dates to remaining actions.
- Prepare an accurate regulator-facing evidence package with counsel.
- Retest controls after organisational or service changes.
Evidence worth retaining
- Privileged-access and recovery-process inventory
- Approved reset and exception procedures
- Authorised test results
- Incident scope and sensitive-data map
- Independent assessment scope and findings
- Recommendation tracker and alternatives
- Control-effectiveness records and correspondence
Questions to take to counsel or your conformity team
These are discussion prompts, not legal advice or conclusions.
- Can an attacker use known personal information to reset a privileged identity?
- Who approves exceptional recovery routes?
- Does independent testing cover the failure mode that enabled the incident?
- What evidence supports closure of each action?
- Which residual risks still need oversight?
Official sources
PrivacyBuilt / PrivacyBuilt is an independent educational publisher. It is not affiliated with, or endorsed by, any regulator or the European Union.
PrivacyBuilt publishes educational and technical guidance. Nothing on this site constitutes legal advice, and it should not be relied on as a legal determination for your organisation.