Canada Bill C-8 / CCSPA
Enacted Canada · Enacted Jun 15, 2026 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Jun 18, 2025 | Bill C-8 introduced15 months ago | 15 months ago |
| Jun 15, 2026 | Royal Assent3 months ago | 3 months ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Requires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.
- Who it applies to
- Designated operators in classes listed in the Act's schedule for vital federal services and systems: finance/banking, telecommunications, energy (pipelines, nuclear, interprovincial power) and transportation.
- Penalties
- Administrative monetary penalties and offences under the CCSPA; exact maxima in the final text not verified here.
- Enforced by
- Sector regulators (e.g. OSFI, CRTC, CER, CNSC, Transport Canada) and the Minister of Public Safety; Communications Security Establishment receives incident reports
- Official name
- Critical Cyber Systems Protection Act (enacted by Bill C-8, An Act respecting cyber security)
- Citation
- S.C. 2026, c. 9 (Bill C-8, 45th Parl., 1st Sess.)
- Topics
- cybersecurity, breach-notification
Research notes
Parliament's LEGISinfo lists Royal Assent on 15 June 2026; the Public Safety Canada news release is dated 16 June 2026. The CCSPA itself comes into force by order in council in phases; no date announced as of late July 2026. Predecessor C-26 proposed 72-hour incident reporting and AMPs up to CAD 15M for organisations; final figures not verified.
Related
Brazil LGPD
Canada Bill C-36 (PPCDA)
Quebec Law 25Questions about Canada Bill C-8 / CCSPA
- What are the Canada Bill C-8 / CCSPA compliance deadlines?
- Jun 18, 2025: Bill C-8 introduced. Jun 15, 2026: Royal Assent.
- Who does Canada Bill C-8 / CCSPA apply to?
- Designated operators in classes listed in the Act's schedule for vital federal services and systems: finance/banking, telecommunications, energy (pipelines, nuclear, interprovincial power) and transportation.
- What are the penalties under Canada Bill C-8 / CCSPA?
- Administrative monetary penalties and offences under the CCSPA; exact maxima in the final text not verified here.