Regulationsby GlyphOntario Bill 194
In force Ontario, Canada · In force Jan 29, 2025 · no upcoming deadlines
Deadlines
FIPPA privacy amendments in forceRemaining FIPPA amendments, including privacy impact assessments, safeguards and breach notification to the IPC, come into force.
Enhancing Digital Security and Trust Act in forceSchedule 1 (cyber security, AI and minors' data framework) and some FIPPA amendments come into force by OIC 361/2025.
Royal AssentBill 194 receives Royal Assent as S.O. 2024, c. 24.
Summaries for reference, not legal advice. Check the official text.
What it does
Enacts the Enhancing Digital Security and Trust Act, 2024, which lets Ontario set cyber security program, incident reporting and AI governance rules for public sector entities, and rules on digital information about minors held by school boards and children's aid societies. It also amends FIPPA to require privacy impact assessments, reasonable safeguards and breach notification to the IPC and affected people where there is a real risk of significant harm.
- Who it applies to
- Ontario ministries and provincial institutions under FIPPA, municipal bodies, children's aid societies and school boards. Private companies are not directly covered.
- Penalties
- No administrative fines in the Act; obligations are enforced through regulations, ministerial directives and IPC review powers.
- Enforced by
- Ontario Ministry of Public and Business Service Delivery and Procurement; Information and Privacy Commissioner of Ontario (FIPPA parts)
- Official name
- Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024
- Citation
- S.O. 2024, c. 24
- Topics
- Cybersecurity, AI, Privacy, Children, Breach notification
Research notes
Detailed cyber security and AI duties depend on regulations and directives made under Schedule 1.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil AI Bill (PL 2338/2023)Risk-based AI framework inspired by the EU AI Act: prohibited (excessive-risk) uses, high-risk system obligations, algorithmic impact assessments, rights for affected persons and copyright remuneration provisions, coordinated by a national AI regulation system (SIA) led by the ANPD.No date setBrazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 days
Questions about Ontario Bill 194
- What are the Ontario Bill 194 compliance deadlines?
- Nov 25, 2024: Royal Assent. Jan 29, 2025: Enhancing Digital Security and Trust Act in force. Jul 1, 2025: FIPPA privacy amendments in force.
- When does Ontario Bill 194 take effect?
- Ontario Bill 194 took effect on Jan 29, 2025.
- Who does Ontario Bill 194 apply to?
- Ontario ministries and provincial institutions under FIPPA, municipal bodies, children's aid societies and school boards. Private companies are not directly covered.
- What are the penalties under Ontario Bill 194?
- No administrative fines in the Act; obligations are enforced through regulations, ministerial directives and IPC review powers.