Privacy Map

Ontario. Cybersecurity. Act

Bill 194 / EDSTAStrengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (SO 2024, c. 24; Bill 194)

Partially in force
Partly verifiedMedium confidence. Exact Royal Assent date (believed 2024-11-25) and proclamation status of Schedule 1 / Sch 2 ss.1-14 not verified.

§1Summary

Synopsis

Enacts the Enhancing Digital Security and Trust Act for public sector entities (cyber programmes and incident reporting, AI accountability, children's digital information in schools and children's aid societies) and amends FIPPA to require PIAs, safeguards and breach reporting.

Key themes
  • public-sector cybersecurity
  • AI accountability
  • children's data
  • PIAs
  • breach notification (RROSH)
Unique features

First Ontario statute regulating public-sector AI use by regulation; FIPPA gains a real-risk-of-significant-harm breach reporting duty and IPC review powers over information practices.

SaaS relevance

SaaS/AI vendors to Ontario ministries, school boards and children's aid societies will see technical standards, AI disclosure and breach-reporting obligations flowed down by contract.

§2Obligations

Extraterritorial
No
Breach notification
FIPPA: IPC and individuals where real risk of significant harm (once proclaimed)

§3Dates

Key dates
  • Adopted
  • In force
  • Royal Assent Nov 2024; Schedule 1 (Enhancing Digital Security and Trust Act) and most FIPPA amendments in Schedule 2 (ss.1-14) commence on proclamation

§4Text and authority

Text
Authority
Ministry of Public and Business Service Delivery; Information and Privacy Commissioner of Ontario

§5Where it applies

Domestic law of
Ontario

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Exact Royal Assent date (believed 2024-11-25) and proclamation status of Schedule 1 / Sch 2 ss.1-14 not verified.