Statement by the Privacy Commissioner regarding the data breach at PowerSchool

February 11, 2025
Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne today issued the following statement to provide an update regarding the privacy breach at PowerSchool, an education technology software company that provides services to several school boards and schools in Canada:

---

My Office has had discussions with PowerSchool representatives and remains actively engaged in this matter to ensure that the organization is taking appropriate steps to respond to the breach.

I have received a breach report from PowerSchool, and my Office has received a complaint. As we continue to obtain information about the incident, I have launched an investigation under the Personal Information Protection and Electronic Documents Act (PIPEDA).

My immediate focus is on ensuring that the company is taking the necessary steps to address the issue and protect Canadians’ personal information, notably breach containment and measures to reduce risks to those affected, as well as actions to prevent future breaches.

PowerSchool has advised my Office that affected Canadians are being notified, and the company is offering credit monitoring and identity protection services.

My Office also remains in close contact with our provincial and territorial privacy counterparts on this matter.

Data breaches have surged over the past decade and this incident once again highlights the growing risks of cyberattacks for all organizations. With a threat environment that is continuously evolving, prioritizing information security is essential and requires constant attention, particularly when dealing with children’s personal information.

Related links

• Preventing and responding to a privacy breach
• What you need to know about mandatory reporting of breaches of security safeguards
• Office of the Privacy Commissioner of Canada – Strategic Plan 2024-2027

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca