Bill C-26: Introduction Of New Mandatory Breach Reporting Requirements In Canada

On June 14, 2022, the House of Commons of Canada introduced Bill C-26, a new cybersecurity bill that will require mandatory reporting of cyberattacks against systems of critical importance to Canadian interests.

Bill C-26¹ enacts the Critical Cyber Systems Protection Act ("CCSPA"), which provides a framework for the protection of cyber systems that are vital to Canada's national security or public safety. CCSPA will require designated organizations known as "vital services" or "vital systems" - including federally regulated banks and clearing systems, telecommunication services, transportation services, and nuclear or other energy systems² - to, among other things:

• establish and implement cyber security programs;