Statement by the Privacy Commissioner regarding reports of a data breach at PowerSchool

January 20, 2025
Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne today issued the following statement regarding a privacy breach at PowerSchool, an education technology software company that provides services to several school boards and schools in Canada:

---

I am aware of reports of a cybersecurity incident at PowerSchool that affected educational platforms that are used in many Canadian schools.

My Office is in contact with the company to obtain more information about this breach and to provide them with information about breach response and reporting requirements under privacy legislation. This will allow us to convey our expectations to the company regarding their response to the breach and to determine next steps.

I am also in contact with my provincial and territorial counterparts regarding this matter.

Championing the privacy rights of children is one of my strategic priorities as children’s personal information is particularly sensitive.

I am concerned about the potential impact that an incident such as this one may have on the personal information of students across the country. Federal privacy law requires that organizations protect personal information with security safeguards appropriate to the sensitivity of the information. This is particularly important when dealing with children’s personal information. 

Related links

• Preventing and responding to a privacy breach
• What you need to know about mandatory reporting of breaches of security safeguards
• Office of the Privacy Commissioner of Canada - Strategic Plan 2024-2027

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca