New guidelines have been drawn up to help businesses take the right steps after a privacy breach, including notifying people after their personal and financial information has been stolen, lost or mistakenly disclosed, says the privacy commissioner of Canada, Jennifer Stoddart.

The guidelines outline some of the key steps in responding to a breach, such as containing it, evaluating the risks associated with it, notifying the people affected and preventing future breaches.

The guidelines call on businesses to notify people that their personal information has been compromised in cases where the breach "raises a risk of harm." For example, there may be a risk of identity theft or fraud in cases where sensitive personal information has been lost or stolen.

Organizations are also encouraged to inform the appropriate privacy commissioner in their province that there has been a breach.

The federal office is currently investigating two high-profile privacy breach cases involving large amounts of personal information.

In one case, the Canadian Imperial Bank of Commerce reported the disappearance of a computer hard drive containing the personal information and financial data of close to half a million clients of its investment subsidiary, Talvest Mutual Funds.

The other investigation, being conducted jointly with the information and privacy commissioner of Alberta, is looking at a breach at TJX Companies Inc., involving thousands of Canadians who shopped at TJX's Winners and HomeSense stores.

"It's clear that most businesses take seriously their responsibilities under Canada's private-sector privacy law," Stoddart said.

She said the new guidelines are voluntary and that there's still a need for federal legislation to compel businesses to notify people when their personal information has been breached.

Earlier this year, Stoddart urged the federal government to amend the Personal Information Protection and Electronic Documents Act (PIPEDA) to make such notification mandatory for businesses.