An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts (S.C. 2026, c. 9)

• (j) to promote the security of the Canadian telecommunications system.

Marginal note:For greater certainty

15.01 For greater certainty, in sections 15.1, 15.2, 15.5 and 15.7, interference with or manipulation, disruption or degradation of a telecommunications system include actions of a technical nature that impede the operation of the telecommunications system but do not include the effect of lawful expression, persuasion or political debate.

Marginal note:Security of Canadian telecommunications system — Order in Council

• 15.1 (1) If the Governor in Council believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, and that it is reasonable in relation to the gravity of that threat, the Governor in Council may, by order and after consultation with the persons the Governor in Council considers appropriate,

  • (a) prohibit a telecommunications service provider from using all products and services provided by a specified person in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities; or

  • (b) direct a telecommunications service provider to remove all products provided by a specified person from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities.

• Marginal note:Scope and substance

  (2) The provisions of the order must, in scope and substance, be necessary and reasonable in relation to the gravity of the threat, including that of interference, manipulation, disruption or degradation.

• Marginal note:Non-disclosure

  (3) The order may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.

• Marginal note:Non-disclosure — factors

  (3.1) Before including in the order a provision to prohibit the disclosure of its existence, or some or all of its contents, the Governor in Council must consider

  • (a) the extent to which the disclosure could, in the Governor in Council’s opinion, compromise the objective of the order;

  • (b) the necessity of including such a provision in light of the nature of the threat;

  • (c) the possibility of limiting the scope of the prohibition;

  • (d) the impact of non-disclosure on the principles of transparency and accountability of the Government of Canada;

  • (e) any representations made by the affected telecommunications service providers; and

  • (f) any other factor that the Governor in Council considers relevant.

• Marginal note:Factors

  (4) Before making the order, the Governor in Council must consider

  • (a) its operational impact on the affected telecommunications service providers;

  • (b) its financial impact on the affected telecommunications service providers;

  • (c) its effect on the provision of telecommunications services in Canada, including on the confidentiality and security of telecommunications;

  • (c.1) its potential impacts on the privacy of Canadians; and

  • (d) any other factor that the Governor in Council considers relevant.

• Marginal note:Prepublication

  (5) The Governor in Council may cause a draft order to be published in the Canada Gazette.

• Marginal note:Publication

  (6) Any order made under subsection (1) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Governor in Council directs otherwise in the order.

• Marginal note:Conflict

  (7) In the event of any inconsistency between an order made under subsection (1) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) prevails to the extent of the inconsistency.

• Marginal note:No compensation

  (8) No one is entitled to any compensation from His Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1).

Marginal note:Security of Canadian telecommunications system — Minister’s order

• 15.2 (1) If there are reasonable grounds to believe that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, and that it is reasonable in relation to the gravity of that threat, the Minister may, by order and after consultation with the Minister of Public Safety and Emergency Preparedness and with the persons the Minister considers appropriate,

  • (a) prohibit a telecommunications service provider from providing any service to any specified person, including a telecommunications service provider; and

  • (b) direct a telecommunications service provider to suspend providing for a specified period any service to any specified person, including a telecommunications service provider.

• Marginal note:Exception

  (1.1) Despite paragraph (1)(b), no order may be made directing the suspension of service to an individual, unless the order is necessary to secure the Canadian telecommunications system against any specified threat of a technical nature.

• Marginal note:Order

  (2) If the Minister believes on reasonable grounds that it is necessary to do so to secure the Canadian telecommunications system against any threat, including that of interference, manipulation, disruption or degradation, and that it is reasonable to do so in relation to the gravity of that threat, the Minister may, by order,

  • (a) prohibit a telecommunications service provider from using any specified product or service in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities;

  • (b) direct a telecommunications service provider to remove any specified product from its telecommunications networks or telecommunications facilities, or any part of those networks or facilities;

  • (c) impose conditions on a telecommunications service provider’s use of any product or service, or any product or service provided by a specified person, including a telecommunications service provider;

  • (d) impose conditions on a telecommunications service provider’s provision of services to a specified person, including a telecommunications service provider;

  • (e) prohibit a telecommunications service provider from entering into a service agreement for any product or service used in, or in relation to, its telecommunications network or telecommunications facilities, or any part of those networks or facilities;

  • (f) require that a telecommunications service provider terminate a service agreement referred to in paragraph (e);

  • (g) prohibit a telecommunications service provider from upgrading any specified product or service;

  • (h) require that a telecommunications service provider’s telecommunications networks or telecommunications facilities, as well as its procurement plans for those networks or facilities, be subject to specified review processes;

  • (i) require that a telecommunications service provider develop a security plan in relation to its telecommunications services, telecommunications networks or telecommunications facilities;

  • (j) require that assessments be conducted to identify any vulnerability in a telecommunications service provider’s telecommunications services, telecommunications networks or telecommunications facilities or its security plan referred to in paragraph (i);

  • (k) require that a telecommunications service provider take steps to mitigate any vulnerability in its telecommunications services, telecommunications networks or telecommunications facilities or its security plan referred to in paragraph (i);

  • (l) require that a telecommunications service provider implement specified standards in relation to its telecommunications services, telecommunications networks or telecommunications facilities;

  • (m) direct a telecommunications service provider to do a specified thing or refrain from doing a specified thing, other than a thing specified in subsection (1) or 15.1(1); or

  • (n) require that a telecommunications service provider use a backup system for telecommunications facilities.

• Marginal note:Private communication

  (2.1) Despite subsection (2), the Minister must not order the decoding of an encrypted private communication, as defined in section 183 of the Criminal Code.

• Marginal note:Scope and substance

  (3) The provisions of an order made under subsection (1) or (2) must, in scope and substance, be necessary and reasonable in relation to the gravity of the threat, including that of interference, manipulation, disruption or degradation.

• Marginal note:For greater certainty

  (4) For greater certainty, despite subsection (2), the Minister is not permitted to order a telecommunications service provider to intercept a private communication or a radio-based telephone communication, as those termsare defined in section 183 of the Criminal Code.

• Marginal note:Non-disclosure

  (5) An order made under subsection (1) or (2) may also include a provision prohibiting the disclosure of its existence, or some or all of its contents, by any person.

• Marginal note:Non-disclosure — factors

  (5.1) Before including in an order made under subsection (1) or (2) a provision to prohibit the disclosure of its existence, or some or all of its contents, the Minister must consider

  • (a) the extent to which disclosure could, in the Minister’s opinion, compromise the objective of the order;

  • (b) the necessity of including such a provision in light of the nature of the threat;

  • (c) the possibility of limiting the scope of the prohibition;

  • (d) the impact of non-disclosure on the principles of transparency and accountability of the Government of Canada;

  • (e) any representations made by the affected telecommunications service providers; and

  • (f) any other factor that the Minister considers relevant.

• Marginal note:Factors

  (6) Before making an order under subsection (1) or (2), the Minister must consider

  • (a) its operational impact on the affected telecommunications service providers;

  • (b) its financial impact on the affected telecommunications service providers;

  • (c) its effect on the provision of telecommunications services in Canada, including on the confidentiality and security of telecommunications;

  • (c.1) its potential impacts on the privacy of Canadians; and

  • (d) any other factor that the Minister considers relevant.

• Marginal note:Prepublication

  (7) The Minister may cause a draft order to be published in the Canada Gazette.

• Marginal note:Publication

  (8) Any order made under subsection (1) or (2) must be published in the Canada Gazette within 90 days after the day on which it is made, unless the Minister directs otherwise in the order.

• Marginal note:Conflict

  (9) In the event of any inconsistency between an order made under subsection (1) or (2) and a decision of the Commission made under this Act or another order made, or any authorization issued, by the Minister under this Act or the Radiocommunication Act, the order made under subsection (1) or (2), as the case may be, prevails to the extent of the inconsistency.

• Marginal note:No compensation

  (10) No one is entitled to any compensation from His Majesty in right of Canada for any financial losses resulting from the making of an order under subsection (1) or (2).

Marginal note:Report on orders

• 15.21 (1) The Minister shall cause to be tabled in each House of Parliament, within three months after the end of each fiscal year or, if either House is not then sitting, on any of the first 15 days of the next sitting of that House, a report on the orders made under subsection 15.1(1) and subsections 15.2(1) and (2).

• Marginal note:Contents of report

  (2) The Minister shall include in the report, for the fiscal year covered by the report, the following information:

  • (a) the number of orders made and the nature of the orders;

  • (b) the number of orders that were revoked;

  • (c) the number of telecommunications service providers affected by an order;

  • (d) a description of compliance of telecommunications service providers that partially complied with an order;

  • (e) a description of compliance of telecommunications service providers that fully complied with an order; and

  • (f) an explanation of the necessity, reasonableness and utility of the orders.

• Marginal note:Contents of report — conflicts

  (3) The report shall state the number of times that an order prevailed over a decision of the Commission made under this Act during previous fiscal year.

Marginal note:Notice by Minister

15.211 The Minister must, within seven days after an order is made under section 15.1 or 15.2 — other than an order that includes a provision prohibiting the disclosure of its existence, or some or all of its contents — give a notice containing the order to any person specified in that order.

Marginal note:Obligation to notify

15.22 The Minister must, within 90 days after an order that includes a provision prohibiting the disclosure of its existence, or some or all of its contents, is made under section 15.1 or 15.2, notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency of the making of the order.

Marginal note:Contravention of unpublished order

• 15.3 (1) No person shall be convicted of an offence consisting of a contravention of an order made under section 15.1 or 15.2 unless it is proved that, at the time of the alleged contravention, the person had been notified of the order.

• Marginal note:Certificate

  (2) A certificate appearing to have been signed by the Minister and stating that a notice containing the order made under section 15.1 or 15.2 was given to persons likely to be affected by it is, in the absence of evidence to the contrary, proof that notice was given to those persons.

• Marginal note:Statutory Instruments Act

  (3) The Statutory Instruments Act does not apply to an order made under section 15.1 or 15.2.

• Marginal note:Incorporation by reference

  (4) An order made under section 15.1 or 15.2 may incorporate any document by reference, in whole or in part, regardless of its source and as it exists on a particular date or as it is amended from time to time.

Marginal note:Provision of information

15.4 The Minister may require any person to provide to the Minister or any person designated by the Minister, within any time and subject to any conditions that the Minister may specify, any information that the Minister believes on reasonable grounds is reasonable to provide in relation to the gravity of the threat and necessary for the purpose of making, amending or revoking an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a), or of verifying compliance or preventing non-compliance with such an order or regulation.

Marginal note:Confidential information — designation

• 15.5 (1) A person who provides any of the following information under section 15.4 may designate it as confidential:

  • (a) information that is a trade secret;

  • (b) financial, commercial, scientific or technical information that is confidential and that is treated consistently in a confidential manner by the person who provided it;

  • (c) information the disclosure of which could reasonably be expected to

    • (i) result in material financial loss or gain to any person,

    • (ii) prejudice the competitive position of any person, or

    • (iii) affect contractual or other negotiations of any person; or

  • (d) personal information and de-identified information.

• Marginal note:Definitions

  (2) The following definitions apply in paragraph (1)(d).

  de-identify

  de-identify means to modify personal information so that an individual cannot be directly identified from it, though a risk of the individual being identified remains. (dépersonnaliser)

  personal information

  personal information has the same meaning as in section 3 of the Privacy Act. (renseignements personnels)

• Marginal note:Information deemed confidential

  (2.1) Personal information and de-identified information that is not designated as confidential under subsection (1) is deemed, for the purposes of this Part, to be designated as such.

• Marginal note:Prohibition

  (3) Subject to subsections (4) and (5), no person shall knowingly disclose or knowingly permit to be disclosed any information that is designated as confidential.

• Marginal note:Exception

  (4) Information referred to in any of paragraphs (1)(a) to (c) that is designated as confidential may be disclosed, or be permitted to be disclosed, if

  • (a) the disclosure is authorized or required by law;

  • (b) the person who designated the information as confidential consents to its disclosure;

  • (c) the disclosure is necessary, in the Minister’s opinion, given the gravity of the threat, to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption; or

  • (d) in the case of information referred to in paragraph (1)(d), the person to whom the information relates consents to its disclosure.

• Marginal note:Exception — paragraph (1)(d)

  (5) Information referred to in paragraph (1)(d) that is designated as confidential may be disclosed, or be permitted to be disclosed, if

  • (a) the disclosure is required by law; or

  • (b) in the Minister’s opinion, the disclosure is necessary to secure the Canadian telecommunications system, including against the threat of interference, manipulation or disruption, and the information, in scope and substance, is reasonable in relation to the gravity of any threat.

Marginal note:Exchange of information

• 15.6 (1) Despite section 15.5, to the extent that is reasonable in relation to the gravity of the threat and necessary for any purpose related to the making, amending or revoking of an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a) — or to verifying compliance or preventing non-compliance with such an order or regulation — the following persons and entities may collect information from and disclose information to each other, including confidential information:

  • (a) the Minister;

  • (b) the Minister of Public Safety and Emergency Preparedness;

  • (c) the Minister of Foreign Affairs;

  • (d) the Minister of National Defence;

  • (e) the Chief of the Defence Staff;

  • (f) the Chief or an employee of the Communications Security Establishment;

  • (g) the Director or an employee of the Canadian Security Intelligence Service;

  • (h) the Chairperson or an employee of the Commission;

  • (i) a person designated under section 15.4; and

  • (j) any other prescribed person or entity.

• Marginal note:Limitation

  (1.1) For the purposes of subsection (1), information referred to in paragraph 15.5(1)(d) must not be collected or disclosed unless its scope and substance is reasonable in relation to the gravity of the threat.

• Marginal note:Confidential information

  (2) Any confidential information that is collected under subsection (1) must be treated as confidential.

Marginal note:Disclosure of information

• 15.7 (1) Any information collected or obtained under this Act, other than information designated as confidential under subsection 15.5(1), may be disclosed by the Minister under an agreement, a memorandum of understanding or an arrangement in writing between the Government of Canada and the government of a province or of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, if

  • (a) the Minister believes that the information may be relevant to securing the Canadian telecommunications system or the telecommunications system of a foreign state, including against the threat of interference, manipulation or disruption; and

  • (b) the agreement, memorandum of understanding or arrangement provides for the disposal of that information once it is no longer necessary for the purpose for which it was disclosed.

• Marginal note:Restriction — use

  (2) If the agreement, memorandum of understanding or arrangement allows for the sharing of information that may be relevant to an investigation or proceeding in respect of a contravention of this Act, an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a) — or a law of a foreign state that addresses conduct that is substantially similar to conduct that would be in contravention of this Act, of an order made under section 15.1 or 15.2 or of a regulation made under paragraph 15.8(1)(a) — the agreement, memorandum of understanding or arrangement must restrict the use of that information to purposes relevant to contraventions of the laws of a foreign state that have consequences that would not be considered penal under Canadian law.

Marginal note:Disposal of information

15.701 Any person who collects or obtains information referred to in paragraph 15.5(1)(d) under this Part, with the exception of section 15.7, must dispose of that information if it is no longer necessary for any purpose related to the making, amending or revoking of an order under section 15.1 or 15.2 or a regulation under paragraph 15.8(1)(a) — or to verifying compliance or preventing non-compliance with such an order or regulation — or in accordance with any requirement under the Privacy Act that applies to that information.

Marginal note:Privacy Act not affected

15.71 For greater certainty, nothing in sections 15.1, 15.2 and 15.4 to 15.7 affects the provisions of the Privacy Act.

Marginal note:Prohibition

15.72 A person who performs or has performed duties or functions in the administration or enforcement of this Act must not disclose or permit to be disclosed to any other person, except to a Canadian law enforcement agency or for the purposes of the administration or enforcement of this Act, the identity of any individual who provided information on their own initiative to the Minister to achieve the objectives of this Act that relate to securing the Canadian telecommunications system and who has requested confidentiality.

Marginal note:Regulations

• 15.8 (1) The Governor in Council may make regulations

  • (a) containing any provision that may be contained in an order made under section 15.2; and

  • (b) prescribing persons and entities for the purposes of paragraph 15.6(1)(j).

• Marginal note:Conflict

  (2) In the event of any inconsistency between a regulation made under paragraph (1)(a) and a decision of the Commission made under this Act or an order made or an authorization issued by the Minister under this Act or the Radiocommunication Act, the regulation prevails to the extent of the inconsistency.

Marginal note:Annual report

• 15.81 (1) The Minister must, within three months after the end of each fiscal year, prepare a report respecting any orders referred to in sections 15.1 and 15.2 that were made during that fiscal year and must cause the report to be laid before each House of Parliament within the first 15 days on which that House is sitting after the report is completed.

• Marginal note:Contents

  (2) The report must include the number of orders that were made in that fiscal year.

• Marginal note:Contents of report — conflicts

  (3) The report must also state the number of times that an order prevailed over a decision of the Commission made under this Act during the previous fiscal year.

• Marginal note:Publication of summary

  (4) The Minister must publish a summary of the report on the website of the Department of Industry within 10 days after the day on which it is tabled in both Houses of Parliament.

Judicial Review

Marginal note:Rules

• 15.9 (1) The following rules apply to judicial review proceedings in respect of an order made under section 15.1 or 15.2 or a regulation made under paragraph 15.8(1)(a):

  • (a) if the judge determines that evidence or other information provided by the Minister is not relevant or if the Minister withdraws the evidence or other information, the decision of the judge must not be based on that evidence or other information and the judge must return it to the Minister; and

  • (b) the judge must ensure the confidentiality of all evidence and other information that the Minister withdraws.

• Marginal note:Definition of judge

  (2) In this section, judge means the Chief Justice of the Federal Court or a judge of that Court designated by the Chief Justice.

Marginal note:Protection of information on appeal

15.91 Section 15.9 applies to any appeal of a decision made by the judge in relation to the judicial review proceedings referred to in that section and to any further appeal, with any necessary modifications.