Cybersecurity law & regulation in Canada (2026)
Cybersecurity in Canada: sectoral rules.
Canada's cybersecurity obligations today are sectoral. A comprehensive framework — the Critical Cyber Systems Protection Act (Part 2 of Bill C-8) — received Royal Assent on 15 June 2026, but its substantive obligations on designated operators are not yet in force and await Governor-in-Council commencement orders. In the meantime, federal cybersecurity duties flow from PIPEDA breach-reporting rules, OSFI Guideline B-13 (financial institutions), Telecommunications Act powers over telecom providers (Part 1 of C-8, now in force), and voluntary CCCS guidance.
Legal framework
Critical Cyber Systems Protection Act (Bill C-8, enacted June 2026 but not yet in force) plus sector-specific regimes: PIPEDA breach-reporting (in force since Nov 2018), OSFI Guideline B-13 for federally regulated financial institutions (effective Jan 2024), and Telecommunications Act cybersecurity amendments (in force June 2026). Guidance and threat coordination are led by the Canadian Centre for Cyber Security (part of the Communications Security Establishment) and the RCMP's National Cybercrime Coordination Centre.
Key points: cybersecurity in Canada
Comprehensive CCSPA enacted but not yet operative
Bill C-8 received Royal Assent on 15 June 2026, enacting the Critical Cyber Systems Protection Act (S.C. 2026, c. 9). Part 2 (CCSPA) will impose cyber-programme, incident-reporting and directives obligations on 'designated operators' in six federally regulated sectors, but comes into force only on dates fixed by Governor in Council — no dates announced as of mid-2026.
Telecommunications Act cyber amendments in force
Part 1 of Bill C-8 (amendments to the Telecommunications Act) took effect on Royal Assent, giving the Minister of Industry authority to order telecom providers to secure networks, prohibit specified equipment/services (e.g. Huawei/ZTE), and mandate compliance measures — with monetary penalties for non-compliance.
PIPEDA mandatory breach reporting
Since 1 November 2018, organizations subject to the Personal Information Protection and Electronic Documents Act must report breaches of security safeguards involving personal information to the Office of the Privacy Commissioner and notify affected individuals 'as soon as feasible' where there is a real risk of significant harm; records of all breaches must be kept. Knowing non-compliance is an offence.
Financial sector: OSFI Guideline B-13
OSFI's Guideline B-13 on Technology and Cyber Risk Management, effective 1 January 2024, requires federally regulated financial institutions to maintain technology and cyber risk governance and controls. A parallel OSFI advisory requires prompt reporting of material technology or cyber incidents to the primary supervisor.
CCSPA scope and penalties (once in force)
Once commenced, the CCSPA will designate operators in six Schedule 1 classes — telecommunications, interprovincial/international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement systems. Operators must establish a cyber-security programme, report cyber incidents to the Communications Security Establishment, and can face administrative monetary penalties of up to C$15 million per violation.
National strategy and lead agencies
The February 2025 National Cyber Security Strategy sets Canada's strategic direction, building on the 2018 strategy. Operationally, the Canadian Centre for Cyber Security (within the Communications Security Establishment) is the technical authority for cyber defence and advisory, while the RCMP's National Cybercrime Coordination Centre (NC3) leads cybercrime coordination.
Timeline of decisions
- Law · officialBill C-8 passes House of Commons, moves to Senate
After substantive committee amendments, the cyber security bill (which enacts the Critical Cyber Systems Protection Act and amends the Telecommunications Act) cleared Third Reading in the House and proceeded to the Senate, the final step before Canada's first mandatory critical-infrastructure cyber regime becomes law.
Parliament of Canada (LEGISinfo)
- Law · officialBill C-8 introduced, reviving cyber-security reform
The Carney government re-tabled the lapsed C-26 provisions as Bill C-8, enacting the Critical Cyber Systems Protection Act to require designated operators in telecom, finance, energy, transport and nuclear to run cyber programs, mitigate supply-chain risk, and report incidents.
Parliament of Canada
- Guidance · officialCanada releases 2025 National Cyber Security Strategy
Public Safety Canada launched a new NCSS with a whole-of-society approach, backed by an initial $37.8M over six years and a new Canadian Cyber Defence Collective, replacing the 2018 strategy as the framework for protecting critical infrastructure.
Public Safety Canada
- Law · officialProrogation kills Bills C-26 and C-27
Parliament was prorogued, causing the cyber-security bill C-26 (CCSPA) and the privacy/AI bill C-27 (CPPA, AIDA) to die on the Order Paper, leaving Canada operating under PIPEDA (2000) with no enacted critical-infrastructure cyber law.
Parliament of Canada (LEGISinfo)
- Enforcement · officialPrivacy Commissioner's special report on CRA/GCKey attacks
The OPC tabled a special report to Parliament finding CRA and ESDC failed to adequately safeguard personal information during the 2020 credential-stuffing attacks, sharpening expectations for federal cyber safeguards and breach handling.
Office of the Privacy Commissioner of Canada
- Guidance · officialOSFI finalizes Guideline B-13 on technology and cyber risk
Canada's banking and insurance regulator issued binding expectations for federally regulated financial institutions across governance, technology resilience and cyber security (effective Jan 1, 2024), establishing the sector's core cyber obligations.
OSFI
- IncidentGCKey/CRA credential-stuffing attacks
Credential-stuffing attacks compromised tens of thousands of Government of Canada online accounts via GCKey and CRA portals, enabling CERB fraud and exposing weaknesses that drove later reforms and an $8.7M class-action settlement.
CBC News
- Law · officialCommunications Security Establishment Act in force
Part of the National Security Act 2017, the CSE Act gave Canada's signals-intelligence agency explicit cyber-security, defensive and active cyber-operations mandates, the statutory backbone for federal cyber defence.
Communications Security Establishment
- Guidance · officialCanadian Centre for Cyber Security established
Under the 2018 National Cyber Security Strategy, Canada consolidated federal cyber operations into a single Cyber Centre within CSE, creating the national authoritative source for cyber guidance, advisories and incident response.
Canadian Centre for Cyber Security
Sources
- canada.ca/en/public-safety-canada/news/2026/06/government-of-canada-strengthens
- parl.ca/DocumentViewer/en/45-1/bill/C-8/royal-assent
- osler.com/en/insights/updates/canadas-bill-c-8-what-businesses-need-to-know-abo
- blg.com/en/insights/2025/07/bill-c8-revives-canadian-cyber-security-reform-wh
- priv.gc.ca/en/privacy-topics/business-privacy/breaches-and-safeguards/privacy-br
- osfi-bsif.gc.ca/en/guidance/guidance-library/technology-cyber-security-incident-repor
- publicsafety.gc.ca/cnt/rsrcs/pblctns/ntnl-cbr-scrt-strtg-2025/index-en.aspx
- canada.ca/en/public-safety-canada/news/2025/02/government-of-canada-introduces-
- priv.gc.ca/en/report-a-concern/report-a-privacy-breach-at-your-organization/repo
Next for Canada: Starting a BusinessEasy
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 20 Aug 2026. Methodology & how to cite · State of Technology Regulation 2026