Regulationsby GlyphCanada Bill C-8 / CCSPA
Enacted Canada · Enacted Jun 15, 2026 · no upcoming deadlines
Deadlines
Royal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.
Bill C-8 introducedFirst reading in the House of Commons.
Summaries for reference, not legal advice. Check the official text.
What it does
Requires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.
- Who it applies to
- Designated operators in classes listed in the Act's schedule for vital federal services and systems: finance/banking, telecommunications, energy (pipelines, nuclear, interprovincial power) and transportation.
- Penalties
- Administrative monetary penalties and offences under the CCSPA; exact maxima in the final text not verified here.
- Enforced by
- Sector regulators (e.g. OSFI, CRTC, CER, CNSC, Transport Canada) and the Minister of Public Safety; Communications Security Establishment receives incident reports
- Official name
- Critical Cyber Systems Protection Act (enacted by Bill C-8, An Act respecting cyber security)
- Citation
- S.C. 2026, c. 9 (Bill C-8, 45th Parl., 1st Sess.)
- Topics
- Cybersecurity, Breach notification
Research notes
Parliament's LEGISinfo lists Royal Assent on 15 June 2026; the Public Safety Canada news release is dated 16 June 2026. The CCSPA itself comes into force by order in council in phases; no date announced as of late July 2026. Predecessor C-26 proposed 72-hour incident reporting and AMPs up to CAD 15M for organisations; final figures not verified.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025
Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysOntario Bill 194Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.In effect since Jan 29, 2025PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001Peru PDPL and 2024 RegulationPeru's 2011 data protection law now runs under a new regulation that replaced the 2013 rules. The regulation adds 48-hour breach notification to the authority, data protection officers phased in by company size, data portability, stronger rules for processors and cross-border transfers, and detailed sanctions procedures.Next: Nov 30 DPO required: medium companies · in 34 days
Quebec Law 25Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.In effect since Sep 22, 2022
Questions about Canada Bill C-8 / CCSPA
- What are the Canada Bill C-8 / CCSPA compliance deadlines?
- Jun 18, 2025: Bill C-8 introduced. Jun 15, 2026: Royal Assent.
- Who does Canada Bill C-8 / CCSPA apply to?
- Designated operators in classes listed in the Act's schedule for vital federal services and systems: finance/banking, telecommunications, energy (pipelines, nuclear, interprovincial power) and transportation.
- What are the penalties under Canada Bill C-8 / CCSPA?
- Administrative monetary penalties and offences under the CCSPA; exact maxima in the final text not verified here.