Provides telecom services, in Canada

CRTC 2009-430 · Read the law's page

• If you are a Canadian carrier, or a reseller whose arrangement with a carrier carries the condition, make the information on your telecommunications services and products on your website accessible to persons with disabilities to the point of providing a reasonable accommodation, choosing how to achieve it; the Commission gives as examples textual content that meets the W3C Web Content Accessibility Guidelines and a text-only version, easily accessed from the home page, that complies with them, and an audit with an action plan for timely improvements; this has applied since July 23, 2012 (paras. 65 to 67 and 70).
• Make accessible any customer service function available solely over your website, and where a customer service function on your website is inaccessible, do not charge or otherwise disadvantage a person with a disability who uses another channel of customer service to reach it (para. 68).
• Promote information on all of your disability-specific services and products in the accessible manners of your choice, and if your website has a special needs or disability section, place an easy-to-find link to it on the home page (paras. 56 and 57).
• Make your general call center accessible to the point of providing a reasonable accommodation by training customer service representatives in handling inquiries from persons with disabilities and making your Interactive Voice Response system accessible, or by transferring calls to a disability call center under appropriate protocols (para. 69).
• Include in your contracts and other agreements or arrangements with resellers a condition that the resellers comply with these requirements (para. 70).

Canadian Radio-television and Telecommunications Commission Accessibility Reporting Regulations, SOR/2021-160 · Read the law's page

• If you carry on a broadcasting undertaking as a regulated entity described in paragraph 7(1)(e) or (f) of the Act in Class B2 (an entity not in another class), your first accessibility plan was due before the expiry of one year after June 1, 2022, and in Class B3 (an entity that has attested to 10 or more but fewer than 100 employees) after June 1, 2023, while an entity that qualifies for a class later has June 1 of the calendar year after the year it qualified (ss. 2(1), 3(1) and (2) with s. 42(1) of the Act); section 3(1) fixes no day for Class B4, an entity that has attested to fewer than 10 employees, and an attestation places you in its class as though you had always been in it (s. 2(2)).
• If you are a Canadian carrier or telecommunications service provider as a regulated entity described in paragraph 7(1)(e) or (f) of the Act in Class T2 (an entity not in another class), your first accessibility plan was due before the expiry of one year after June 1, 2022, and in Class T3 (an attested 10 or more but fewer than 100 employees) after June 1, 2023, while an entity that qualifies for a class later has June 1 of the calendar year after the year it qualified (ss. 18(1), 19(1) and (2) with s. 51(1) of the Act); section 19(1) fixes no day for Class T4 (an attested fewer than 10 employees) or Class T5, a service that is offered without an explicit charge, on a temporary basis only on the entity's premises, or without autonomous two-way voice or Internet access.
• Publish an updated plan no later than the third anniversary of the day the plan was last required to be published (ss. 6 and 22).
• Publish each plan, feedback process description and progress report on the main digital platform you own, operate or control and use to communicate information to the public, conspicuously on the homepage or by a hyperlink from it, in clear, simple and concise language and in a format that meets the requirements of Level AA conformance of the WCAG, as amended from time to time, with a header for each element the Act requires (ss. 1(1), 4, 5, 10, 13, 14, 20, 21, 26, 29 and 30).
• Notify the Commission electronically within 48 hours after publishing each version of a plan, feedback process description or progress report, with a hyperlink to its URL (ss. 7, 12, 17, 23, 28 and 33).
• On request, make the plan, feedback process description or progress report available in print, large print, braille, audio format, an electronic format compatible with adaptive technology or another agreed format, within 45 days for braille or audio and otherwise within 15 days (Class B2 and Class T2) or 20 days (Class B3 and Class T3) (ss. 8, 11, 15, 24, 27 and 31).
• Allow feedback by telephone, email, an online form if you have one, or another designated means, allow it to be anonymous, designate and publicly identify a person to receive it, acknowledge receipt of feedback other than anonymous feedback, and, subject to the Personal Information Protection and Electronic Documents Act and the Privacy Act, keep the personal information of a person who gives feedback confidential unless the person consents to disclosure (ss. 9 and 25).
• Publish the description of your feedback process before the end of your fixed day, and publish an updated description as soon as feasible whenever you update the process (ss. 10(2) and (3) and 26(2) and (3)).
• Publish a progress report by June 1 in each year in which no accessibility plan is due (ss. 16 and 32).

Telecommunications Act (S.C. 1993, c. 38), ss. 15.1, 15.2, 72.131 and 73(3.1) · Read the law's page

• This binds a telecommunications service provider, once the Governor in Council or the Minister has made an order under section 15.1 or 15.2 that names you or your products or services, or once the Governor in Council has made a regulation under section 15.8(1)(a) containing a provision an order under section 15.2 could contain (reached by declaring that you provide telecommunications services). Neither order power reaches a manufacturer as such.
• Comply with an order of the Governor in Council under section 15.1 that prohibits you from using the products and services of a specified person in your telecommunications network or facilities, or directs you to remove the products of a specified person (section 15.1(1)).
• Comply with an order of the Minister under section 15.2 that prohibits you from providing any service to a specified person, or directs you to suspend providing a service to a specified person for a specified period (section 15.2(1)).
• Comply with an order of the Minister under section 15.2(2) that prohibits you from using a specified product or service in your network or facilities, directs you to remove a specified product, or imposes conditions on your use of a product or service.
• Comply with an order of the Minister under section 15.2(2), or a regulation under section 15.8(1)(a) containing the same provision, that imposes conditions on your provision of services to a specified person, prohibits you from entering into a service agreement or from upgrading a specified product or service, requires you to terminate a service agreement, subjects your networks, facilities and procurement plans to specified review, requires you to develop a security plan, have vulnerability assessments conducted and mitigate the vulnerabilities, implement specified standards or use a backup system, or directs you to do or refrain from a specified thing (section 15.2(2)(d) to (n)).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 17, 18 and 136 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Report a cyber security incident in respect of any of your critical cyber systems to the Communications Security Establishment, in accordance with the regulations, within the period the regulations prescribe, which may not exceed 72 hours (section 17).
• Immediately after reporting, notify the appropriate regulator that the report was made, in the form and manner the regulations prescribe, and give it a copy of the report (section 18).
• Keep records of every cyber security incident you reported under section 17 (section 30).

Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11), ss. 7-9, 12, 15 and 137 · Read the law's page

• This does not bind anyone yet: the Act is not in force, and it binds a designated operator, being a person, partnership or unincorporated organization that belongs to a class of operators the Governor in Council adds to Schedule 2 in respect of a vital service or vital system named in Schedule 1 (telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, transportation systems within federal authority, banking systems, and clearing and settlement systems), reached by declaring that you operate an essential service, provide telecommunications services or provide financial services.
• Within 90 days after you become a member of a class of operators set out in Schedule 2, establish a cyber security program in respect of your critical cyber systems, with steps to identify and manage organizational cyber security risks, protect those systems from being compromised, detect cyber security incidents and minimize their impact (section 9(1)).
• Notify the appropriate regulator in writing, immediately after the program is established, that it has been established, and provide the program to the regulator within 90 days after you become a member of the class (sections 9(2) and 10).
• Implement the program by taking the steps it includes, and maintain the program (section 12).
• Review the program each year, or on the dates the regulations prescribe, and notify the appropriate regulator whether changes were made (section 13).
• Mitigate any cyber security risk in your supply chain or your use of third-party products and services as soon as it has been identified (section 15).