Digital Policy Alert logo

Canada: Critical Cyber Systems Protection Act (Bill C-8) including cybersecurity obligations for designated operators received royal assent

Policy overview

Description

Critical Cyber Systems Protection Act (Bill C-8) including cybersecurity obligations for designated operators received royal assent

On 15 June 2026, the Critical Cyber Systems Protection Act, introduced as Bill C-8 in the 45th Parliament, received royal assent and became law as Statutes of Canada, 2026, chapter 9. The Act establishes mandatory cybersecurity programme requirement…

Scope

Policy Area
Data governance
Policy Instrument
Cybersecurity regulation
Regulated Economic Activity
cross-cutting
Implementation Level
national
Government Branch
executive
Government Body
central government

Complete timeline of this policy change

Hide details
2025-06-18
under deliberation

On 18 June 2025, the Minister of Public Safety introduced the Bill on respecting cybersecurity, ame…

2026-03-26
under deliberation

On 26 March 2026, the House of Commons passed the Bill on respecting cybersecurity, amending the T…

2026-06-04
adopted

On 4 June 2026, the Senate adopted the Bill respecting cyber security, amending the Telecommunicati…

2026-06-15
adopted

On 15 June 2026, the Critical Cyber Systems Protection Act, introduced as Bill C-8 in the 45th Parl…