| Bill C-8 · Critical Cyber Systems Protection Act (CCSPA)An Act respecting cyber security · S.C. 2026, c. 9 | Law · phasedRoyal assent on 15 Jun 202619. The Telecommunications Act amendments applied at once; the CCSPA comes into force in phases by order, with programme details set by regulations1820. | Designated operators in finance, telecoms, energy and transport keep a cyber security programme, manage supply-chain and third-party risk, report cyber incidents to the Communications Security Establishment within 72 hours and keep records. Penalties reach CA$15M per violation per day for organisations and CA$500,000 for individuals20. | Implication: operators will push programme and reporting duties to every supplier.
Response: managed SOC with 72-hour reporting runbooks, supplier-risk evidence and OT assessments. |
| PIPEDAPersonal Information Protection and Electronic Documents Act · federal private sector | In forceRemains the federal private-sector privacy law while Bill C-36 is before Parliament21. | Consent, accountability for personal information sent to service providers, safeguards and breach reporting. We did not re-verify PIPEDA's detailed breach-reporting terms or its provincial exemptions in this pass. | Implication: every customer contract needs privacy and processing terms.
Response: privacy operations adapted to PIPEDA, DLP and data kept in Canada by default. |
| Bill C-36 · Protecting Privacy and Consumer Data ActWould replace Part 1 of PIPEDA · successor to the lapsed Bill C-27 | Bill · first readingTabled on 15 Jun 2026 by the Minister of Artificial Intelligence and Digital Innovation. Its coming into force is tied to Bill C-3421. | Privacy management programme, plain-language consent, de-identified data still treated as personal information, disclosure of automated systems with legal or similarly significant effects, a higher standard for children's data. A new Digital Safety and Data Protection Commission could order and audit. Penalties up to CA$10M or 3% of global revenue; fines up to CA$25M or 5%21. | Implication: privacy programmes will need audit-ready evidence.
Response: GRC evidence, vDPO and AI decision records via ISO/IEC 42001. |
| Quebec Law 25Act to modernize legislative provisions as regards the protection of personal information | Fully in forcePhased in from 22 Sep 2022; the last provisions, including data portability, applied from 22 Sep 202422. | A privacy officer (the CEO by default), reporting confidentiality incidents with a risk of serious injury, privacy impact assessments, including before personal information leaves Quebec, opt-in consent for tracking technologies, and data portability within 30 days. Administrative penalties up to CA$10M or 2% of worldwide turnover; fines up to CA$25M or 4%2223. | Implication: Mumbai support for Quebec data needs a documented assessment.
Response: Canadian hosting, logged access, PIA templates via vDPO and cookie controls on retail platforms. |
| OSFI Guideline B-13Technology and Cyber Risk Management · federally regulated financial institutions (FRFIs) | In forceReleased 13 Jul 2022, effective 1 Jan 202424. | Expected outcomes in three domains: governance and risk management, technology operations and resilience, and cyber security. OSFI's separate incident-reporting advisory complements it24. | Response: managed SOC, PAM, Cloud HSM and red-team testing. |
| OSFI Guideline B-10Third-Party Risk Management · FRFIs | In forceIn force since May 2024 (vendor summary)26. | Governance, risk assessment, contracts, monitoring, technology and cyber transparency and independent assessment for every third party, scaled by risk. Institutions must know where vendor data is hosted and under which jurisdiction, and assess subcontractor risk26. | Implication: XcellHost will be assessed as a third party, with Indian operations in scope.
Response: a ready B-10 due-diligence pack: ISO certificates, SOC 2 reports, data-location map and exit plan. |
| OSFI Guideline E-21Operational Risk Management and Resilience · FRFIs | Full adherence duePublished 22 Aug 2024. Sections 1–2 applied at once; full adherence by 1 Sep 202625. Scenario testing across all critical operations by 1 Sep 2027 (vendor summary)26. | Recovery plans that assume third-party failure, a return-to-service target for each critical third party, tested workarounds and concentration-risk analysis26. | Implication: banks and insurers buy tested recovery, not just backup.
Response: resilience operations with measured drills, backup and DR and a second-provider exit plan. |
| OSFI Guideline E-23Model Risk Management, including AI models · FRFIs (not pension plans) | Final · applies 2027Final on 11 Sep 2025; effective 1 May 202727. | An enterprise model-risk framework, a model inventory with risk ratings, lifecycle testing and monitoring, and third-party models and data brought under B-1027. | Implication: every AI tool an FRFI uses needs an inventory entry and controls.
Response: ISO/IEC 42001, AI security assessments and vCAIO advisory. |
| National AI Strategy "AI for All"Federal strategy · no general AI law since AIDA lapsed in Jan 2025 | PolicyReleased 4 Jun 2026, with targets for 2031 and 203430. | No comprehensive AI law. Planned targeted laws on deepfakes, surveillance pricing, chatbot and social-media safety, and AI-enabled election interference. A Canadian Trusted AI Certification, CA$50M for the AI Safety Institute, a National AI Literacy Initiative and AI training for 1 million post-secondary students30. | Implication: adoption funding and literacy targets create training demand.
Response: AI training programmes, live online AI literacy and governance to ISO/IEC 42001. |
| Ontario Bill 194Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 · EDSTA + FIPPA amendments | Law · by regulationRoyal assent on 25 Nov 202433. EDSTA regulations on public-sector cyber security governance came into force on a 1 July date; the source does not state the year34. | Public-sector entities, including school boards and children's aid societies, run cyber security programmes and can be regulated on AI use. FIPPA now requires privacy impact assessments before collection and breach reports to the Information and Privacy Commissioner33. | Response: Government Cloud, education cloud, awareness training and ISO 27001 programmes. |
| Canadian Program for Cyber Security Certification (CPCSC)Public Services and Procurement Canada · defence suppliers | Level 1 liveLevel 1 introduced on 14 Apr 2026, required in select defence contracts from summer 2026, at contract award only for now. Levels 2 and 3 to follow "in the coming years"28. | Suppliers attest to the Level 1 criteria for protecting specified information, linked to the Cyber Centre's new industrial standard (ITSP.10.171)28. | Implication: self-attestation now, third-party levels later.
Response: gap work via audit and GRC; controlled information handled only by Canadian-based staff or partners. |
| Federal PQC migration roadmapCyber Centre ITSM.40.001 · Government of Canada systems | Policy · datedPublished 23 Jun 202529. | Departmental migration plans by April 2026 with annual reporting, high-priority systems migrated by the end of 2031 and all remaining systems by the end of 203529. | Implication: suppliers to government will be asked for a crypto inventory.
Response: crypto inventory, PQC readiness and managed PKI. |
| Public TLS certificate lifetimesCA/Browser Forum ballot SC081v3 · applies to all publicly trusted certificates | Phasing inMaximum validity fell to 200 days on 15 Mar 2026. It falls to 100 days on 15 Mar 2027 and to 47 days on 15 Mar 202939. | Manual certificate renewal stops scaling. Every public web, API and mail endpoint needs automated issuance and renewal. | Implication: a dated trigger for every vertical.
Response: 47-day SSL automation, CLM and private CA. |
| GST/HST & entityFederal sales tax · non-resident suppliers · company formation | Partly verifiedGST is 5%; HST is 13% or 15% depending on the province. Non-resident digital suppliers to consumers have used simplified registration since 1 Jul 2021, above CA$30,000 of sales in 12 months35. The Digital Services Tax was rescinded on 29 Jun 202536. | Not verified in this pass: B2B supplies to registered businesses, Quebec's QST, provincial sales taxes, entity type and withholding on payments to India. The tax source is dated Mar 2023. | Response: a Canadian legal and tax memo is a month 0–6 task. See pricing & tax. |
| Provincial health-privacy and private-sector lawsFor example Ontario PHIPA, and Alberta and British Columbia private-sector acts | Not verified hereWe did not re-verify provincial health or private-sector privacy laws in this pass. | Health custodians and their providers follow provincial rules that sit beside PIPEDA. Confirm which law applies to each customer. | Response: include a provincial-law check in every healthcare and public-sector deal. |