Ontario's Bill 194: cyber security in the public sector

Bill 194 received Royal Assent in November 2024. It did two main things. It created a new statute, the Enhancing Digital Security and Trust Act, which lets the province set cyber security and artificial intelligence requirements for public sector entities by regulation and directive. And it amended the Freedom of Information and Protection of Privacy Act (FIPPA), adding mandatory breach reporting, privacy impact assessments and stronger oversight by the Information and Privacy Commissioner of Ontario (IPC).

Much of the detail sits in regulations and later amendments rather than in the bill itself, so the practical requirements have been arriving in stages. The IPC maintains an updates page for institutions that tracks what is in force and when.

The Enhancing Digital Security and Trust Act applies to public sector entities as defined in the Act, which include institutions under FIPPA and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), school boards and children's aid societies, with specific additional rules for digital information about children held by school boards and children's aid societies. The Legislative Assembly was excluded from the definition.

The FIPPA changes apply to provincial institutions: ministries, agencies and other bodies covered by FIPPA. Equivalent changes to MFIPPA for municipal institutions such as municipalities, police services boards and many local boards were made later, with their own in-force dates.

Private-sector companies are not directly regulated by Bill 194. But public bodies are expected to flow many of these requirements into their contracts with suppliers.

The Enhancing Digital Security and Trust Act lets the provincial cabinet make regulations requiring prescribed public sector entities to develop and implement cyber security programs and to submit reports about cyber security incidents, with different requirements for different types of incidents. A regulation can require a program to include roles and responsibilities for specified individuals, progress reporting, education and awareness measures, response and recovery measures for cyber security incidents, and oversight of the program. The Minister can also set technical standards by regulation and issue directives that entities must follow, and directives can differ by class of entity. Because these requirements apply only to the entities a regulation or directive names, and from the dates it sets, each institution should confirm what applies to it.

The IPC's summary of the changes lists the key privacy requirements and in-force dates shown in the table below.

The IPC says the RROSH assessment considers the sensitivity of the information, the probability of misuse and whether the individual can take steps to reduce or mitigate harm, among other factors, and that qualifying breaches must be reported to the IPC and individuals notified as soon as feasible. A separate 2026 budget measures bill also changed access-request rules from July 1, 2026, including moving the general response time from 30 calendar days to 45 business days, and excluded certain cyber security records from access requests.

The Enhancing Digital Security and Trust Act also addresses artificial intelligence systems used by public sector entities. It allows the province to require entities to provide information to the public about their use of AI systems, to develop and implement accountability frameworks, to manage risks, and to have humans oversee AI systems, again with detail set by regulation and directive. For institutions, the practical starting point is an inventory of AI systems in use, a risk-based approval process and plain-language public information about where AI is used.

Our article on FIPPA and MFIPPA for vendors covers these contract issues in more detail.

• Contract clauses requiring prompt notice of security incidents and privacy breaches, so the institution can meet its own RROSH and reporting duties.
• Cooperation obligations during investigations, including access to logs and forensic findings.
• Requests for information to support the institution's privacy impact assessments.
• Security requirements aligned with the province's standards, and evidence that you meet them.
• Disclosure of any AI features in your product and how they use institutional data.
• Data location and sub-processor questions.