Ontario Introduces Cyber And Educational Technology Regulations

On March 23, 2026, the Ministry of Public and Business Service Delivery and Procurement published two regulations under the Enhancing Digital Security and Trust Act, 2024 (EDSTA). O. Reg. 51/26 (Cyber Security) and O. Reg. 52/26 (Digital Technology Affecting Individuals Under Age 18) will both come into force on July 1, 2026. These regulations impose new governance, reporting, and transparency obligations on a broad range of Ontario public sector institutions, including universities, colleges, school boards, hospitals, and children’s aid societies.

O. Reg. 51/26 – Cyber security

O. Reg. 51/26 applies to “prescribed public sector entities,” which include colleges, universities, most public hospitals, school boards, children’s aid societies, and other specifically named public sector entities.