Ontario

In the Enhancing Digital Security and Trust Act, 2024, a public sector entity is an institution under the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution under the Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board. Section 5 applies to the public sector entities a regulation prescribes for it that use or intend to use an artificial intelligence system in prescribed circumstances.

Such an entity must, in accordance with the regulations, provide information to the public about its use of the system. It must also, in accordance with the regulations, develop and implement an accountability framework respecting its use of the system. It must take such steps as may be prescribed to manage the risks associated with its use of the system. It must use the system in accordance with any prescribed requirements.

It must not use an artificial intelligence system if the regulations prohibit the use. Section 6 applies to the public sector entities a regulation prescribes for it. When such an entity uses an artificial intelligence system in prescribed circumstances, it must disclose information about the use in accordance with the regulations, and ensure that an individual exercises oversight of the use and provides additional information, in accordance with the regulations.

Use of an artificial intelligence system by a public sector entity includes use of a system that is publicly available, developed or procured by the entity, or developed by a third party on its behalf. Section 8 lets the Minister make regulations setting technical standards that the public sector entities the Minister prescribes must conform to in their use of artificial intelligence systems.

Ontario Regulation 51/26 prescribes public sector entities for the purpose of section 2 of the Act, which concerns cyber security. Ontario Regulation 52/26 prescribes every school board for the purposes of section 9 of the Act, which concerns digital information about individuals under age 18. Nothing in the Act or in a regulation or directive made under it establishes a private law duty of care owing to any person.

A failure to comply with the Act or with a regulation or directive made under it does not affect the validity of any policy, Act, regulation, directive, instrument or decision. The Act received Royal Assent on November 25, 2024. Section 17 of the Schedule provides that the Act comes into force on a day to be named by proclamation of the Lieutenant Governor. The Act was not in force before January 29, 2025.

Section 8.4(1) requires an employer that advertises a publicly advertised job posting and uses artificial intelligence to screen, assess or select applicants for the position to include in the posting a statement disclosing that use. The duty binds an employer with 25 or more employees on the day the posting is posted, and a smaller employer is exempt from the whole of Part III.1 under Ontario Regulation 476/24.

That Regulation also supplies the regulation-defined terms artificial intelligence and publicly advertised job posting, the second excluding a general recruitment campaign or help wanted sign not for a specific position, a posting restricted to existing employees, and a posting for work to be performed outside Ontario, or partly outside Ontario where the work outside Ontario is not a continuation of work performed in Ontario.

Section 8.4(2) exempts a posting that meets criteria prescribed by regulation. Every publicly advertised job posting under this Part, including one carrying this disclosure statement, must be retained by the employer for three years after it is removed from public access, under section 15(7.1) of the Act, a duty that reaches every such posting whether or not it discloses artificial intelligence use.

If personal health information in a custodian's custody or control is stolen or lost, or is used or disclosed without authority, the custodian must notify the individual at the first reasonable opportunity and include in the notice a statement that the individual is entitled to make a complaint to the Commissioner. If the circumstances meet the prescribed requirements, the custodian must also notify the Commissioner.

The regulation prescribes those circumstances, which include reasonable grounds to believe that the information was stolen, and reasonable grounds to believe that it was used or disclosed without authority by a person who knew or ought to have known that. The prescribed circumstances also include a loss or unauthorized use or disclosure that is part of a pattern of similar losses or unauthorized uses or disclosures of personal health information in the custody or control of the custodian.

A further prescribed circumstance is the custodian's determination that the loss or unauthorized use or disclosure is significant after considering all relevant circumstances, including the sensitivity of the information, the volume of information and the number of individuals affected. The custodian must notify the Commissioner of such a circumstance at the first reasonable opportunity.

On or before March 1 in each year a custodian must give the Commissioner a report of the number of times in the previous calendar year that personal health information in its custody or control was stolen, lost, used without authority or disclosed without authority. An agent of a custodian must notify the custodian at the first reasonable opportunity if personal health information that the agent handled on the custodian's behalf is stolen or lost or is used or disclosed without authority.

A custodian that employs a health care practitioner who is a member of a College must give the College written notice within 30 days if the employee is terminated, suspended or subject to disciplinary action as a result of unauthorized collection, use, disclosure, retention or disposal of personal health information.

If the prescribed organization determines that digital health identifier records have been stolen, lost or used or disclosed without authority, it shall, at the first reasonable opportunity, notify the individual to whom the personal health information relates. The notice to the individual must include a statement that the individual is entitled to make a complaint to the Commissioner under Part VI.

The prescribed organization shall, in accordance with the regulations, if any, notify the Commissioner of a theft or loss of or an unauthorized use or disclosure of digital health identifier records if the circumstances meet the prescribed requirements.

The circumstances in which the Agency must notify the Commissioner include reasonable grounds to believe that a digital health identifier record was used or disclosed without authority by a person who knew or ought to have known that they were doing so, and reasonable grounds to believe that a digital health identifier record was stolen. The Agency shall notify the Commissioner of the existence of such a circumstance at the first reasonable opportunity.

The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. On or before March 1 in each year starting in 2027, the Agency shall provide the Commissioner with a report setting out the number of times in the previous calendar year that digital health identifier records were stolen, lost, used without authority or disclosed without authority, and that personal health information was collected by the Agency for the purposes of Part V.2 without authority. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted section 55.24, was in force on 1 January 2026.

A health information custodian may disclose personal health information about an individual collected in Ontario to a person outside Ontario only if one of the grounds in subsection 50 (1) is met. The grounds are the individual's consent, a disclosure that the Act permits, and a recipient that performs functions comparable to those of a person to whom the Act would permit the custodian to disclose the information in Ontario in listed cases.

A further ground covers a disclosure by a prescribed entity for health planning or health administration to the government of another province or territory about care provided in Ontario to a resident of that province or territory.

Two more grounds cover a disclosure reasonably necessary for the provision of health care to the individual, which is not available if the individual has expressly instructed the custodian not to make it, and a disclosure reasonably necessary for the administration of payments in connection with health care or for contractual or legal requirements in that connection.

If an individual's instruction prevents the custodian from disclosing all the information it considers reasonably necessary for the provision of health care, the custodian must notify the recipient of that fact.

An individual has a right of access to a record of personal health information about the individual that is in the custody or under the control of a health information custodian, subject to the exceptions the Act lists. An individual exercises the right by making a written request to the custodian that has custody or control of the information, and the request must contain sufficient detail to enable the custodian to identify and locate the record with reasonable efforts.

The custodian must respond as soon as possible in the circumstances but no later than 30 days after receiving the request, and may extend that period by not more than 30 days in the cases the Act describes. A custodian that refuses a request in whole or in part must give the individual a written notice.

If an individual who has been granted access believes that the record is inaccurate or incomplete for the purposes for which the custodian collects, uses or has used the information, the individual may request in writing that the custodian correct the record. The custodian must grant, refuse or extend the time to reply to a correction request no later than 30 days after receiving it.

The custodian must grant the correction if the individual demonstrates, to the custodian's satisfaction, that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives the custodian the information necessary to correct the record.

A custodian is not required to correct a record that it did not originally create if it lacks sufficient knowledge, expertise and authority to correct it, or a professional opinion or observation that it made in good faith about the individual.

Part V applies to the prescribed organization as if it were a health information custodian, and as if it had custody or control of a record of personal health information that is accessible to health information custodians by means of the electronic health record developed and maintained by the prescribed organization, subject to prescribed exceptions and additional requirements.

Part V applies to the prescribed organization as if it were a health information custodian with respect to an electronic record the prescribed organization keeps under paragraphs 4, 5 and 6 of section 55.3, subject to prescribed exceptions and additional requirements. Part V applies to the prescribed organization as if it were a health information custodian with respect to digital health identifier records, subject to prescribed exceptions and additional requirements.

Part V applies to a record in the custody or control of a health information custodian respecting all instances where all or part of an individual's personal health information that is accessible by means of the electronic health record is viewed, handled or otherwise dealt with by the custodian, subject to prescribed exceptions and additional requirements.

An individual is not entitled to request a correction by the prescribed organization when it acts as if it were a health information custodian with respect to the records described in subsection 51 (5), (6) or (7). An individual is not entitled to request a correction by a health information custodian with respect to the records described in subsection 51 (8).

The Agency shall make available an electronic system or systems to act as a digital means of access that permits individuals who have a digital health identifier and who are specified by the Agency on its website to access the records described in subsection 18.1.1 (2) of the regulation. From 1 January 2028 the regulation requires the Agency to make available both the digital means of access and an alternative process for individuals who cannot or do not wish to use the digital means of access.

The Agency shall provide an annual report to the Commissioner with respect to the previous calendar year. The Agency shall provide the report to the Commissioner on or before March 1 in each year starting in 2027. Section 5 of Schedule 6 to chapter 7 of 2025, which enacted subsections 51 (5) to (8), was in force on 1 January 2026. Section 6 of Schedule 6 to chapter 7 of 2025, which enacted subsections 55 (1.1) and (1.2), was in force on 1 January 2026.

No person may use or attempt to use information that has been de-identified to identify an individual, either alone or with other information, unless the Act or another Act permits the information to be used to identify the individual, subject to any prescribed exceptions.

The limit does not prevent a health information custodian, a prescribed entity mentioned in subsection 45 (1), a prescribed person who compiles or maintains a registry of personal health information, or any other prescribed person from using information that they de-identified to identify an individual.

To de-identify personal health information means to remove any information that identifies the individual or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify the individual.

A person who has reasonable grounds to believe that another person has contravened or is about to contravene a provision of the Act or its regulations may make a complaint to the Commissioner.

After a review the Commissioner may order any person whose activities the Commissioner reviewed to perform a duty imposed by the Act or its regulations, to cease collecting, using or disclosing personal health information in contravention of the Act, or to return, transfer or dispose of records collected, used or disclosed in contravention of the Act.

The Commissioner may also order a person whose activities the Commissioner reviewed to pay an administrative penalty, for the purposes of encouraging compliance or preventing the person from deriving any economic benefit from a contravention. The power to order an administrative penalty has been in force since March 25, 2020. The regulation that sets the maximum amounts, filed on November 14, 2023, came into force on January 1, 2024.

Under the regulation, an administrative penalty for any number of contraventions set out in an order may not exceed $50,000 for a natural person and $500,000 for a person that is not a natural person, and the Commissioner may increase the amount by the economic benefit the person acquired from the contraventions.

An order requiring payment of an administrative penalty may not be issued more than two years after the day the most recent contravention on which it is based first came to the knowledge of the Commissioner. An order that has become final may be filed with the Superior Court of Justice and is then enforceable as a judgment or order of that court.

A person is guilty of an offence if the person wilfully collects, uses or discloses personal health information in contravention of the Act or its regulations.

The offences also include contravening the health number rules in subsection 34 (2), (3) or (4), wilfully contravening the limit on using de-identified information to identify an individual, wilfully disposing of a record in contravention of the secure disposal duty, wilfully failing to comply with an order of the Commissioner, and making a request under the Act for access to or correction of a record under false pretences.

A person who is a natural person and is convicted is liable to a fine of not more than $200,000 or to imprisonment for not more than one year, or to both, and a person that is not a natural person is liable to a fine of not more than $1,000,000. An officer, member, employee or other agent of a corporation who authorized the offence, or who had the authority to prevent it and knowingly refrained from doing so, is a party to and guilty of the offence.

A prosecution may not be commenced without the consent of the Attorney General or the Attorney General's agent. The penalties in subsection 72 (2) are as amended by chapter 5 of the Statutes of Ontario, 2020, in force from March 25, 2020. If the Commissioner has made an order that has become final, a person affected by the order may commence a proceeding in the Superior Court of Justice for damages for actual harm suffered as a result of a contravention of the Act or its regulations.

A person affected by the conduct that gave rise to an offence of which a person has been convicted may commence a proceeding for damages for actual harm once the conviction has become final. If the harm was caused by a contravention or offence that the defendants engaged in wilfully or recklessly, the court may include in its award of damages an award, not exceeding $10,000, for mental anguish.

A consumer reporting agency is a person who for gain or profit or on a regular co-operative non-profit basis furnishes consumer reports, and a consumer report is a communication by such an agency of credit information or personal information, or both, pertaining to a consumer for consideration in connection with a purpose set out in clause 8 (1) (d).

No person may conduct or act as a consumer reporting agency, or act as a personal information investigator, unless registered by the Registrar under the Act.

A consumer reporting agency may knowingly furnish information from its files only in response to a court order, on the written instructions of the consumer, in response to an order or direction under the Act, or in a consumer report given to a person it has reason to believe intends to use the information for credit, a tenancy, employment purposes, insurance underwriting, eligibility under a statute or regulation, a direct business need in connection with a business or credit transaction, or updating a report previously given.

No person may knowingly obtain information from the files of a consumer reporting agency respecting a consumer except for those purposes. A consumer reporting agency must adopt all procedures reasonable for ensuring accuracy and fairness in the contents of its consumer reports.

A consumer reporting agency must not report information that is not extracted from information appearing in files stored or collected in a repository located in Canada, whether or not the information was obtained from a source outside Canada, except that a written report may contain the substance of prior information orally acquired that conforms to the Act.

A consumer report must not include information as to race, creed, colour, sex, ancestry, ethnic origin or political affiliation, or any other adverse item of information more than seven years after it was acquired or last reaffirmed. A person must give a consumer written notice before requesting or obtaining a consumer report containing personal information about the consumer.

Where a benefit is denied to a consumer or a charge to a consumer is increased wholly or partly because of information received from a consumer reporting agency or another person, the user of the information must deliver notice of that fact to the consumer when the action is communicated. A consumer may in writing request a consumer reporting agency to provide the consumer's consumer report, or the consumer's current consumer score and consumer report.

A consumer may dispute the accuracy or completeness of an item of information in the consumer's file, and the agency must use its best endeavours to confirm or complete the information and correct, supplement or delete it in accordance with good practice. The security freeze provisions, under which a prescribed consumer reporting agency places, suspends and terminates a security freeze on a consumer's file, have been in force since July 1, 2026.

A person convicted of an offence under the Act is liable to a fine of not more than $50,000 or to imprisonment for not more than one year, or to both, and a corporation convicted is liable to a fine of not more than $250,000. A person who contravenes the Act or the regulations is liable to a consumer for any damages sustained by the consumer as a result of the contravention, and the consumer may commence an action in the Superior Court of Justice. The provisions this entry describes came into force on different days.

A consumer electronic service provider is a person who provides electronic services to individuals at their request, primarily for the purpose of allowing those individuals to access, use, disclose, modify, maintain or otherwise manage their records of personal health information, or for other prescribed purposes. In providing electronic services to an individual, a consumer electronic service provider must comply with the prescribed requirements.

If authorized by the individual who requested its services, the provider may collect and use health numbers in accordance with any prescribed rules in order to verify the identity of the individual or for any other prescribed purpose. A health information custodian that provides personal health information to a consumer electronic service provider must comply with any prescribed requirements or procedures.

A custodian that receives an individual's request for access from a consumer electronic service provider is not required to provide the personal health information to the provider in responding to the request. No proclamation naming the day this section comes into force has been located.

The Act binds a health information custodian, a class that includes health care practitioners, hospitals, pharmacies, laboratories, long-term care homes and ambulance services, and it also binds an agent acting for a custodian.

A custodian must not collect, use or disclose personal health information about an individual unless it has the individual's consent and the collection, use or disclosure is, to the best of the custodian's knowledge, necessary for a lawful purpose, or unless the Act permits or requires it. A consent must be a consent of the individual, must be knowledgeable, must relate to the information and must not be obtained through deception or coercion.

A custodian must not collect, use or disclose personal health information if other information will serve the purpose, and must not collect, use or disclose more than is reasonably necessary to meet the purpose. A custodian must not collect, use or disclose personal health information for the purpose of marketing anything or for the purpose of market research unless the individual expressly consents.

A custodian must take steps that are reasonable in the circumstances to ensure that personal health information in its custody or control is protected against theft, loss and unauthorized use or disclosure. A custodian must have in place information practices that comply with the Act and its regulations, and must make available to the public a written statement of those practices.

A custodian is responsible for personal health information that its agents collect, use, disclose, retain or dispose of on its behalf. A person that is not a health information custodian and to whom a custodian discloses personal health information may use or disclose it only for the purpose for which the custodian was authorized to disclose it, or to carry out a statutory or legal duty, subject to the exceptions in the Act and its regulations.

The Agency, the corporation continued by section 3 of the Connecting Care Act, 2019, is prescribed as the prescribed organization for the purposes of the Act. The Agency is an agent of the Crown and may exercise its powers only as an agent of the Crown. The prescribed organization may, in accordance with Part V.2 and the regulations, carry out digital health identifier activities.

The prescribed organization may, with the express consent of the individual to whom the personal health information relates, collect or use personal health information for the purpose of carrying out digital health identifier activities.

In carrying out digital health identifier activities, the prescribed organization shall not collect, use or disclose personal health information if other information will serve the purpose, or collect, use or disclose more personal health information than is reasonably necessary to meet the purpose.

On and after the first anniversary of the day section 55.19 comes into force, the prescribed organization shall have in place and comply with practices and procedures for protecting the privacy of the individuals whose personal health information is in the digital health identifier records, approved by the Commissioner.

The prescribed organization shall make available to the public a plain language description of the activities or services it provides under Part V.2, including a general description of the technical, administrative and physical safeguards in place.

The prescribed organization shall take steps that are reasonable in the circumstances to ensure that digital health identifier records are protected against theft, loss and unauthorized use or disclosure, and against unauthorized copying, modification or disposal. The prescribed organization shall ensure that a digital health identifier that has been inactive for two or more years is disposed of in a secure manner.

The prescribed organization shall assess the threats, vulnerabilities and risks to the security and integrity of digital health identifier records, and how its digital health identifier activities may affect the privacy of the individuals to whom the information relates. The prescribed organization shall carry out every directive that the Minister issues to it under section 55.26 about digital health identifiers and digital health identifier activities. Section 8 of Schedule 6 to chapter 7 of 2025, which enacted Part V.2, was in force on 1 January 2026.

Subject to any prescribed exceptions, a health information custodian that uses electronic means to collect, use, disclose, modify, retain or dispose of personal health information must maintain, or require the maintenance of, an electronic audit log, audit and monitor the log as often as the regulations require, and comply with any prescribed requirements. The custodian must provide a copy of the electronic audit log to the Commissioner on request.

The log must include, for every instance in which a record or part of a record of personal health information that is accessible by electronic means is viewed, handled, modified or otherwise dealt with, the type of information, the date and time, the identity of all persons who dealt with it, and the identity of the individual to whom it relates. No proclamation naming the day this section comes into force has been located.

A person who provides goods or services for the purpose of enabling a health information custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information must comply with the requirements the regulations prescribe. A supplier of services that is not an agent of the custodian must not use any personal health information to which it has access in the course of providing the services except as necessary in providing them.

That supplier must not disclose any personal health information to which it has access in the course of providing the services. That supplier must not permit its employees or any person acting on its behalf to have access to the information unless they agree to comply with the same restrictions.

A health information network provider is a person who provides services to two or more health information custodians, primarily to enable the custodians to use electronic means to disclose personal health information to one another.

A health information network provider must notify every applicable custodian at the first reasonable opportunity if it accessed, used, disclosed or disposed of personal health information other than as the supplier restrictions allow, or if an unauthorized person accessed the information.

A health information network provider must give each applicable custodian a plain language description of its services and safeguards, and must make that description, and its directives, guidelines and policies that apply to the services, available to the public to the extent they do not reveal a trade secret or confidential scientific, technical, commercial or labour relations information.

A health information network provider must, to the extent reasonably practical, keep an electronic record of all accesses to and transfers of the information held in equipment it controls and make it available to a custodian on request, and must perform and give each custodian a written copy of the results of an assessment of threats, vulnerabilities and risks to the security and integrity of the information and of how the services may affect the privacy of the individuals concerned.

A health information network provider must enter into a written agreement with each custodian that describes the services, describes the administrative, technical and physical safeguards, and requires the provider to comply with the Act and the regulations. A custodian that uses goods or services from such a supplier is not considered to disclose personal health information to the supplier if the supplier complies with those requirements.

A person who is neither a health information custodian nor acting as an agent of a custodian must not collect or use another person's health number except for the purposes the Act lists.

The listed purposes include purposes related to the provision of provincially funded health resources to that other person, the purposes for which a custodian has disclosed the number to the person, and, for a prescribed person acting with the express consent of the other person, accurately identifying that person's records of personal health information, verifying their identity or linking their records.

That person must not disclose a health number except as required by law, subject to any prescribed exceptions. No person may require the production of another person's health card, but a person who provides a provincially funded health resource to a person who has a health card may require its production. The Act applies to the collection, use or disclosure of a health number by any person.

An offer, the acceptance of an offer or any other matter material to the formation or operation of a contract may be expressed by an act intended to result in electronic communication, such as touching or clicking on an appropriate icon or other place on a computer screen. Subsection 19 (1) applies unless the parties agree otherwise. A contract is not invalid or unenforceable by reason only of being in electronic form.

A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents. Nothing in the Act requires a person who uses, provides or accepts information or a document to use, provide or accept it in an electronic form without the person's consent. Consent may be inferred from a person's conduct if there are reasonable grounds to believe that the consent is genuine and is relevant to the information or document.

The Enhancing Digital Security and Trust Act, 2024 was enacted by an Act that was assented to on November 25, 2024. The Lieutenant Governor in Council may make regulations governing cyber security at public sector entities as may be prescribed, including regulations requiring them to develop and implement programs for ensuring cyber security. The Minister may issue directives to public sector entities respecting cyber security.

A public sector entity to whom a directive is issued shall comply with the directive. A public sector entity is an institution within the meaning of the Freedom of Information and Protection of Privacy Act other than the Assembly, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a children's aid society or a school board.

The Minister is the Minister of Public and Business Service Delivery and Procurement or another member of the Executive Council designated to administer the Act. Failure to comply with the Act or with a regulation made or directive issued under it does not affect the validity of any policy, Act, regulation, directive, instrument or decision. Nothing in the Act or in a regulation made or directive issued under it establishes a private law duty of care owing to any person.

Ontario Regulation 51/26 prescribes as public sector entities an educational institution as defined in the Freedom of Information and Protection of Privacy Act, a public hospital graded as a Group A, B or C hospital under the Public Hospitals Act, the University of Ottawa Heart Institute, a children's aid society and a school board.

Every prescribed public sector entity shall develop and implement a program for ensuring cyber security that satisfies, at a minimum, the requirements set out in the Regulation. Each prescribed public sector entity shall designate one of its employees as its primary point of contact for ensuring cyber security and another employee as an alternate.

A designated primary point of contact or alternate must hold a senior management position and have decision-making authority with respect to cyber security at the entity. The entity shall give the Chief Information Security Officer of the Ministry the contact details of its primary point of contact and alternate and notice of any change as soon as reasonably practical but no later than 10 business days following the change.

An entity shall, subject to an election under subsection 5 (2), complete an initial cyber security maturity assessment no later than one year after the day the Regulation first applies to it, and a further assessment at least once within every subsequent two-year period, and an entity that completed an assessment within one year before that day may elect to consider it the initial assessment.

No later than 30 business days after the completion of a cyber security maturity assessment, the entity shall submit a summary of the assessment to the Chief Information Security Officer of the Ministry. Ontario Regulation 51/26 comes into force on July 1, 2026.

The provisions of the Ontario Cyber Security Standard are given force by requirements of section 3B.2.4 of the Transmission System Code and section 6.8.3 of the Distribution System Code. Compliance with those codes is a condition of the Ontario Energy Board's electricity transmitter and electricity distributor licences, respectively.

The Standard's original effective date is October 1, 2024, and version 3.1 of it was issued on November 6, 2025. The Ontario Energy Board issued version 2.0 on December 16, 2024, effective immediately, with requirements for transmitters and distributors to periodically complete an independent cyber security assessment.

A transmitter or distributor shall participate in the IESO's Lighthouse service and will confirm its participation as required by the Ontario Energy Board. A transmitter or distributor shall implement the listed Cyber Security Framework control objectives at maturity indicator level 2 and report on their implementation.

A transmitter or distributor shall obtain an independent assessment in accordance with the schedule the Ontario Energy Board determines from time to time. A transmitter or distributor shall submit the completed independent assessment report to the Ontario Energy Board, signed by its Chief Executive Officer, on or before the reporting deadline the Board establishes.

Following the review of a report, the Ontario Energy Board may require a transmitter or distributor to submit an action plan providing the steps it intends to take.

A critical cyber security incident is, with respect to a prescribed public sector entity, an incident that has impacted the security, continuity, confidentiality, integrity or availability of digital information the entity collects, uses, retains or discloses, or the infrastructure housing or transmitting that information, and that satisfies at least one of the criteria in the Regulation.

The criteria are a significant adverse impact to the delivery of public services by the entity, a risk to public safety, significant efforts to recover digital information or related infrastructure or activation of cyber security incident response plans, and a significant risk of harm to the reputation of and public confidence in the entity.

The entity shall report a critical cyber security incident to the Chief Information Security Officer of the Ministry as soon as reasonably practical but no later than 72 hours after the entity has confirmed that it occurred.

A report shall include, but is not limited to, the names of the primary point of contact and alternate, the name of the entity, the name of the ministry responsible for overseeing it, the date and time the incident occurred, the date and time of confirmation and a general description of the incident.

Nothing in the reporting section affects other legal obligations the entity may have in respect of a critical cyber security incident, including any obligations under the Freedom of Information and Protection of Privacy Act. The Lieutenant Governor in Council may make regulations governing cyber security at prescribed public sector entities, including regulations requiring them to submit reports to the Minister or a specified individual in respect of incidents relating to cyber security. Ontario Regulation 51/26 comes into force on July 1, 2026.

A transmitter or distributor shall notify the IESO of a cyber security incident involving it by submitting a cyber security incident report to the IESO by the end of the next business day following the confirmation that a cyber security incident has occurred.

A cyber security incident is a confirmed, intentional, successful, and unauthorized action to gain access to, modify, destroy, delete, or render unavailable information or any information technology or operating technology network or system that is owned, operated or used by the transmitter or distributor.

A transmitter or distributor shall complete the four questions that determine whether a report is a notable cyber security incident report, and the IESO shares notable reports with the Ontario Energy Board in accordance with its licence requirements.

Where a transmitter or distributor becomes aware of new information that materially alters the content of a submitted report, it shall submit a revised report to the IESO by the end of the next business day following the receipt of the new information.

A transmitter or distributor shall respond to an information request by the IESO or the Ontario Energy Board related to a cyber security incident, including about its security controls, processes and risks, within the timeline stated at the time of the request. The Ontario Energy Board's version 3.0 of the Standard requires licensed electricity distributors and transmitters to report cyber security incidents to the Independent Electricity System Operator starting September 22, 2025.

Section 4 applies the Act to every person or organization in the public and private sectors of Ontario. Section 6 lets the Lieutenant Governor in Council make regulations establishing accessibility standards. Section 13 requires a person or organization to whom a standard applies to comply with it within the time period the standard sets. Section 14 requires that person or organization to file an accessibility report with a director annually or at the other times the director specifies.

The same section requires the filed report to be made available to the public. Section 21 lets a director order a person or organization that contravened a standard to comply and to pay an administrative penalty. Section 37 makes it an offence to fail to comply with an order of a director or the Tribunal. A fine under section 37 is up to $50,000 for each day or part of a day, and up to $100,000 for each such day if the person is a corporation.

A director or officer of a corporation who fails the duty of reasonable care to prevent an offence is liable to a fine of up to $50,000 for each day or part of a day. Among the changes made by the 2016 amendment is a power for a director to extend the time for compliance to accommodate a person with a disability. The Act came into force on Royal Assent on June 13, 2005.

Section 6 requires large organizations and small organizations to have regard to the accessibility for persons with disabilities when designing, procuring or acquiring self-service kiosks. A kiosk is an interactive electronic terminal, including a point-of-sale device, intended for public use that allows users to access one or more services or products or both. The Regulation as filed set January 1, 2014 for large organizations and January 1, 2015 for small organizations.

Section 15 (1) requires every obligated organization that is an educational or training institution, if notification of need is given, to provide educational or training resources or materials in an accessible format.

The institution does so by procuring through purchase or obtaining by other means an accessible or conversion ready electronic format of the resources or materials, where available, or by arranging for a comparable resource in an accessible or conversion ready electronic format if they cannot be procured, obtained by other means or converted.

Section 15 (1) also requires the institution to provide student records and information on program requirements, availability and descriptions in an accessible format to persons with disabilities.

Section 15 (2) defines an educational or training institution as an obligated organization governed by the Education Act or the Ontario Career Colleges Act, 2005, one that offers all or part of a post-secondary program leading to a degree under a consent granted under the Post-secondary Education Choice and Excellence Act, 2000, a designated public sector organization described in paragraph 3 or 4 of Schedule 1, a public or private organization that provides courses or programs that result in a diploma or certificate named by the Minister of Education, or a private school within the meaning of the Education Act.

As filed, section 15 (3) required large organizations to meet the section from January 1, 2013 and small organizations from January 1, 2015. Ontario Regulation 165/16 revoked subsections 15 (3) and 16 (3). Section 16 (1) requires obligated organizations that are school boards or educational or training institutions, in addition to the training that section 7 requires, to provide educators with accessibility awareness training related to accessible program or course delivery and instruction.

Section 16 (2) requires them to keep a record of the training, including the dates on which it is provided and the number of individuals to whom it is provided. Educators are employees who are involved in program or course design, delivery and instruction, including staff of school boards. Section 16 (3) as filed set the same dates for the section.

Section 18 (1) requires the libraries of educational or training institutions that are obligated organizations, where available, to provide, procure or acquire by other means an accessible or conversion ready format of print, digital or multimedia resources or materials for a person with a disability, upon request. Section 18 (2) exempts special collections, archival materials, rare books and donations from that requirement.

Section 18 (3) requires print-based resources or materials to meet it by January 1, 2015 and digital or multimedia resources or materials by January 1, 2020. The information and communications standards do not apply to products and product labels except as the Part specifically provides, to unconvertible information or communications, or to information the organization does not control directly or indirectly through a contractual relationship, except as sections 15 and 18 require.

They are unconvertible if it is not technically feasible to convert them. They are also unconvertible if the technology to convert them cannot readily be obtained. If an obligated organization determines that information or communications are unconvertible, it must give the requester an explanation as to why and a summary of the unconvertible information or communications.

Section 17 (1) requires every obligated organization that is a producer of educational or training textbooks for educational or training institutions to make accessible or conversion ready versions of the textbooks available to the institutions upon request.

Section 17 (2) requires every obligated organization that is a producer of print-based educational or training supplementary learning resources for educational or training institutions to make accessible or conversion ready versions of the printed materials available to the institutions upon request. Section 17 (3) requires accessible or conversion ready versions of textbooks by January 1, 2015 and of the printed supplementary learning resources by January 1, 2020.

The information and communications standards do not apply to products and product labels except as the Part specifically provides, to unconvertible information or communications, or to information the organization does not control directly or indirectly through a contractual relationship, except as sections 15 and 18 require. They are unconvertible if it is not technically feasible to convert them. They are also unconvertible if the technology to convert them cannot readily be obtained.

Section 14 requires designated public sector organizations and large organizations to make their internet websites and web content conform with WCAG 2.0, initially at Level A and increasing to Level AA.

By January 1, 2014 the new internet websites and web content of a large organization had to conform with WCAG 2.0 Level A. By January 1, 2021 all internet websites and web content must conform with WCAG 2.0 Level AA, other than two success criteria, Captions (Live) and Audio Descriptions (Pre-recorded).

Section 14 applies, except where meeting the requirement is not practicable, to websites and web content, including web-based applications, that an organization controls directly or through a contractual relationship that allows for modification of the product, and to web content published on a website after January 1, 2012.

An internet website is a collection of related web pages, images, videos or other digital assets that are addressed relative to a common Uniform Resource Identifier and accessible to the public. A new internet website is a website with a new domain name or a website with an existing domain name undergoing a significant refresh. The Regulation defines the Guidelines as the Recommendation dated December 2008. The Regulation was made on April 13, 2011 and filed on June 3, 2011.

Part IV.2 applies to obligated organizations that are providers of goods, services or facilities. Section 80.46 requires every provider to develop, implement and maintain policies governing its provision of goods, services or facilities to persons with disabilities. Section 80.50 requires every provider to establish a process for receiving and responding to feedback about the manner in which it provides goods, services or facilities to persons with disabilities.

Section 80.50 also requires the feedback process to be accessible to persons with disabilities through accessible formats and communication supports on request. Section 80.47 requires a provider to permit a person with a disability accompanied by a guide dog or other service animal to enter its premises with the animal, unless the animal is otherwise excluded by law from the premises.

Section 80.48 requires a provider to give notice to the public of a temporary disruption in the facilities or services that persons with disabilities usually use. Section 80.49 requires every provider to ensure that its employees, volunteers and the other persons who provide its goods, services or facilities receive training about providing them to persons with disabilities. Several documentation and notice duties in Part IV.2 apply to a provider other than a small organization.

Section 80.51 requires a provider to give a document to a person with a disability in an accessible format or with communication support on request. Ontario Regulation 165/16 added Part IV.2 to the Regulation. Ontario Regulation 165/16 came into force on July 1, 2016 and revoked Ontario Regulation 429/07, the earlier accessibility standards for customer service.

Under Ontario Regulation 429/07 those standards had applied to providers of goods or services other than designated public sector organizations on and after January 1, 2012.

Section 10 applies sections 9, 11, 12 and 13 to all obligated organizations. An obligated organization is the Government of Ontario, the Legislative Assembly, a designated public sector organization, a large organization or a small organization. Section 11 requires an obligated organization that has processes for receiving and responding to feedback to make them accessible through accessible formats and communication supports on request.

Section 12 requires every obligated organization on request to provide or arrange accessible formats and communication supports in a timely manner and at no more than the regular cost charged to other persons. The schedule in section 12 (5) gives large organizations until January 1, 2016 and small organizations until January 1, 2017.

Section 13 requires an obligated organization that prepares emergency procedures, plans or public safety information and makes it available to the public to provide it in an accessible format or with communication supports on request. Section 13 originally required organizations to meet it by January 1, 2012.

The information and communications standards do not apply to products and product labels except as the Part provides, to unconvertible information or communications, or to information the organization does not control directly or indirectly through a contractual relationship, except as sections 15 and 18 require.