How should researchers respond to a privacy breach?

• A. Ignore and continue research.
• B. Contain the breach, notify REB and affected participants as required, investigate, and implement corrective actions.
• C. Only notify participants.
• D. Respond only after regulators require.

Answer: (B)

When a privacy breach occurs in research, the primary goal is to protect participants and minimize harm. The best response is to act quickly to contain the breach, notify the Research Ethics Board (REB) and affected participants as required by policy and consent, investigate to understand what happened, and implement corrective actions to prevent recurrence. Containment stops further exposure and harm, while timely notification ensures those affected can take appropriate steps and maintains trust. The REB’s involvement keeps ethical oversight intact and helps ensure the response aligns with TCPS2 requirements. Investigating the breach reveals the root causes and informs effective fixes, and corrective actions demonstrate accountability and strengthen privacy safeguards for future work.

Why the other options don’t fit: ignoring the breach is unethical and violates participants’ rights and policy obligations. notifying only participants misses the crucial steps of stopping ongoing risk and obtaining ethical oversight. waiting to respond until regulators mandate it delays harm reduction and undermines responsible research practice.