Short answer
For most Ontario businesses, the cybersecurity law that applies today is PIPEDA, Canada's federal private-sector privacy law: you must report breaches that pose a real risk of significant harm, notify the people affected, and keep a record of every breach. Bill C-8, the new federal cyber security law, received Royal Assent on June 15, 2026, but its main part targets critical infrastructure operators and is not yet in force. If you do business in Quebec, Quebec's private-sector privacy law adds its own incident rules. This article explains the law; it is not legal advice.
Bill C-8 and the Critical Cyber Systems Protection Act
Bill C-8, An Act respecting cyber security, received Royal Assent on Monday, June 15, 2026, as Statutes of Canada 2026, chapter 9 (LEGISinfo: Bill C-8). One of its parts enacts the Critical Cyber Systems Protection Act. As of this writing, the Justice Laws Website lists that Act as enacted but not in force (Justice Laws: Critical Cyber Systems Protection Act).
Who it covers
The Act applies to designated operators in the federally regulated sector. Its Schedule 1 lists six vital services and systems:
- Telecommunications services
- Interprovincial or international pipeline and power line systems
- Nuclear energy systems
- Transportation systems that are within the legislative authority of Parliament
- Banking systems
- Clearing and settlement systems
What designated operators will have to do
Once those provisions are in force and an operator is designated, the Act requires it to:
- Establish a cyber security program within 90 days of becoming a designated operator, covering risk management, protection, detection and limiting the impact of incidents.
- Report cyber security incidents affecting its critical cyber systems to the Communications Security Establishment within a period set by regulation, not to exceed 72 hours.
- Identify and mitigate cyber security risks in its supply chain and its use of third-party products and services.
Why a small business should still pay attention
Most small businesses will never be designated operators. But the supply-chain duty means banks, telecom providers, utilities and federally regulated transportation companies will have a legal reason to look harder at the security of their suppliers. If you sell to them, expect more security questions in contracts and renewals once the Act takes effect. The same basics also appear on cyber insurance questionnaires.
PIPEDA: the breach rules that apply now
Businesses subject to PIPEDA must report any breach of security safeguards that creates a real risk of significant harm to an individual to the Office of the Privacy Commissioner of Canada (OPC) (OPC: Assess if a privacy breach poses a real risk of significant harm). The OPC is clear that this covers small businesses as well as large ones (OPC: What you need to know about mandatory reporting of breaches). In practice, PIPEDA requires you to:
- Report breaches that pose a real risk of significant harm to the OPC.
- Notify the affected individuals about those breaches.
- Keep records of all breaches, whether or not they pose a real risk of significant harm.
- Keep each breach record for 24 months after the day you determine the breach occurred (OPC: 2019 Breach record inspections).
A ransomware attack or a compromised email account that exposes client files can trigger these duties. Our PIPEDA compliance guide covers the rest of the law, from consent to safeguards.
Quebec: confidentiality incidents under Law 25
Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25, sets its own rules for private businesses subject to it, which matters if you do business in Quebec (LégisQuébec: chapter P-39.1). If you have cause to believe a confidentiality incident has occurred, you must take reasonable measures to reduce the risk of injury. If the incident presents a risk of serious injury, you must promptly notify the Commission d'accès à l'information and the people whose information is involved. You must also keep a register of confidentiality incidents. The Act provides penal fines of up to $25,000,000, or 4% of worldwide turnover if greater, for enterprises that fail to report an incident when required.
Ontario: Bill 194 and the public sector
Ontario's Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, received Royal Assent on November 25, 2024 (Statutes of Ontario 2024, chapter 24) (Legislative Assembly of Ontario: Bill 194). It enacts the Enhancing Digital Security and Trust Act, 2024, which allows regulations on cyber security and artificial intelligence at public sector entities, including school boards and children's aid societies. Its cyber security rules are aimed at public sector entities, not private businesses, but if you supply IT, software or services to Ontario public sector organizations, their requirements may flow into your contracts.
What to do in 2026
The Canadian Centre for Cyber Security publishes baseline cyber security controls for small and medium organizations. Working through them puts you in a good position for every law above. For a typical Ontario business, start with:
- Know what personal information you hold and where it lives, including email and cloud storage.
- Write an incident response plan that includes the PIPEDA reporting steps and, if you serve Quebec, the Law 25 steps.
- Keep a breach log, even for small incidents. PIPEDA requires it.
- Turn on multi-factor authentication, keep systems patched, and keep tested backups.
- If you sell to banks, telecoms, utilities or federally regulated transport companies, ask them what security evidence they will expect from suppliers.
How shawcsIT helps
Our cybersecurity services include managed detection and response, multi-factor authentication, security awareness training and vulnerability assessments. Our business continuity team helps you build and document an incident response plan, so your staff know who to call and what to record when something goes wrong. We are an IT provider, not a law firm: for legal questions about your obligations, speak with a lawyer.
We have helped Ontario businesses with their technology since 1983. Call 705-742-2204 or schedule a free consultation to review your security against these rules.
FAQ
Is Bill C-8 law in Canada?
Yes. Bill C-8 received Royal Assent on June 15, 2026. The Critical Cyber Systems Protection Act it enacts is listed on the Justice Laws Website as not yet in force, so its program and incident reporting duties do not apply until the government brings them into force and designates operators.
Does the Critical Cyber Systems Protection Act apply to my small business?
Only if you are a designated operator in one of the six federally regulated vital services: telecommunications, interprovincial or international pipelines and power lines, nuclear energy, federally regulated transportation, banking, or clearing and settlement. Suppliers to those operators may still see new security requirements through their contracts.
Do I have to report a data breach in Canada?
Under PIPEDA, you must report a breach of security safeguards to the Office of the Privacy Commissioner if it creates a real risk of significant harm to an individual, notify the affected people, and keep a record of every breach for 24 months. Quebec has its own rules for enterprises in Quebec.
What is cybersecurity compliance in Canada for a small business?
For most small businesses it means protecting personal information under PIPEDA, reporting and recording breaches, and meeting the security requirements in your contracts and cyber insurance policy. The Canadian Centre for Cyber Security's baseline controls are a practical starting point.
Sources
- Bill C-8 (45-1), An Act respecting cyber security (LEGISinfo, Parliament of Canada)
- Critical Cyber Systems Protection Act (Justice Laws Website)
- What you need to know about mandatory reporting of breaches of security safeguards (Office of the Privacy Commissioner of Canada)
- Assess if a privacy breach poses a real risk of significant harm to an individual (Office of the Privacy Commissioner of Canada)
- 2019 Breach record inspections (Office of the Privacy Commissioner of Canada)
- Act respecting the protection of personal information in the private sector, chapter P-39.1 (LégisQuébec)
- Bill 194, Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (Legislative Assembly of Ontario)
- Baseline cyber security controls for small and medium organizations (Canadian Centre for Cyber Security)