Critical Cyber Systems Protection Act (S.C. 2026, c. 9, s. 11)

Marginal note:Exchange of information by appropriate regulator

• The following provision is not in force.

  28 (1) If it is necessary for the protection of vital services, vital systems or critical cyber systems, the appropriate regulator for a class of operators may provide the Minister or the responsible minister with any information, including any confidential information, that is related to the exercise of the appropriate regulator’s powers or the performance of its duties and functions under this Act or the regulations. However, if for the same reason the Minister or the responsible minister makes a request for the information, the appropriate regulator must provide the information so requested.

• The following provision is not in force.

  Marginal note:Confidential information

  (2) Any confidential information, within the meaning of this Act or any other Act of Parliament that applies to or is administered by the appropriate regulator, that is provided under subsection (1) must be treated as confidential.

Marginal note:Request for information

29 For the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, a regulator may request that a person, partnership or unincorporated organization provide it with any information, and the person, partnership or unincorporated organization, as the case may be, must provide the requested information within the time and in the manner set out in the request.

Marginal note:Disposal of personal information

29.1 Any personal information, as defined in section 3 of the Privacy Act, that is collected or obtained under this Act must be disposed of if it is no longer necessary for the purposes for which it was collected or obtained or for verifying compliance or preventing non-compliance with this Act, and in accordance with any requirement under the Privacy Act that applies to it.

Marginal note:For greater certainty

29.2 For greater certainty, nothing in this Act affects the provisions of the Communications Security Establishment Act in relation to the protection of personal information.

Marginal note:Records

• The following provision is not in force.

  30 (1) Every designated operator must keep records respecting

  • The following provision is not in force.

    (a) any steps taken to implement the designated operator’s cyber security program;

  • The following provision is not in force.

    (b) every cyber security incident that the designated operator reported under section 17;

  • The following provision is not in force.

    (c) any steps taken by the designated operator under section 15 to mitigate any supply-chain or third-party risks;

  • The following provision is not in force.

    (d) any measures taken by the designated operator to implement a cyber security direction; and

  • The following provision is not in force.

    (e) any matter prescribed by the regulations.

• The following provision is not in force.

  Marginal note:Place

  (2) The records must be kept in Canada by the designated operator at any place that is prescribed by the regulations — or, if no place is prescribed, at the designated operator’s place of business — and in the manner and for the period determined by the appropriate regulator unless another manner or period is prescribed by the regulations.

Marginal note:No liability

• The following provision is not in force.

  31 (1) A person who exercises powers or performs duties or functions under this Act is not liable in respect of anything done or omitted to be done in good faith in the exercise of those powers or the performance of those duties or functions.

• The following provision is not in force.

  Marginal note:Immunity — accompanying persons

  (2) A person referred to in subsection 32(5), 41(5), 50(5), 59(5), 68(5) or 78(5) is not liable for anything done or omitted to be done in good faith while helping any other person in the exercise of their powers or the performance of their duties and functions under this Act.

Marginal note:Authority to enter place — Superintendent

• The following provision is not in force.

  32 (1) Subject to section 33, the Superintendent may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which the Superintendent has reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

• The following provision is not in force.

  Marginal note:Powers of entry

  (2) For the purpose referred to in subsection (1), the Superintendent may

  • The following provision is not in force.

    (a) examine anything in the place;

  • The following provision is not in force.

    (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

  • The following provision is not in force.

    (c) prepare a document, or cause one to be prepared, based on the information;

  • The following provision is not in force.

    (d) examine any record, report, data or other document and make copies of it or take extracts from it;

  • The following provision is not in force.

    (e) use any copying equipment in the place or cause it to be used; and

  • The following provision is not in force.

    (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• The following provision is not in force.

  Marginal note:Return of document, record or cyber system

  (3) If the Superintendent removes any document, record or cyber system under paragraph (2)(f), the Superintendent must return it to its owner or the person in charge of it, on completion of the examination or copying.

• The following provision is not in force.

  Marginal note:Duty to assist

  (4) Every owner or person in charge of a place that is entered by the Superintendent and every person found in the place must give the Superintendent all reasonable assistance to enable the Superintendent to exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this Act and provide the Superintendent with any document or information, or access to any data, that the Superintendent may reasonably require.

• The following provision is not in force.

  Marginal note:Persons accompanying

  (5) The Superintendent may be accompanied by any other person that the Superintendent believes is necessary to help the Superintendent exercise the Superintendent’s powers or perform the Superintendent’s duties and functions under this section.

• The following provision is not in force.

  Marginal note:Entering private property

  (6) The Superintendent and any person accompanying the Superintendent may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).

Marginal note:Dwelling-house

• The following provision is not in force.

  33 (1) In the case of a dwelling-house, the Superintendent is not authorized to enter it without the occupant’s consent except under the authority of a warrant issued under subsection (2).

• The following provision is not in force.

  Marginal note:Authority to issue warrant

  (2) A justice of the peace may, on ex parte application, issue a warrant authorizing the Superintendent to enter a dwelling-house, subject to any conditions specified in the warrant, if the justice of the peace is satisfied by information on oath that

  • The following provision is not in force.

    (a) the dwelling-house is a place referred to in subsection 32(1);

  • The following provision is not in force.

    (b) entry to the dwelling-house is necessary for a purpose referred to in subsection 32(1); and

  • The following provision is not in force.

    (c) entry to the dwelling-house was refused by the occupant or there are reasonable grounds to believe that it will be refused or to believe that consent to entry cannot be obtained from the occupant.

• The following provision is not in force.

  Marginal note:Use of force

  (3) In executing the warrant, the Superintendent is not entitled to use force unless the use of force has been specifically authorized in the warrant and the Superintendent is accompanied by a peace officer.

Marginal note:Internal audit order

• The following provision is not in force.

  34 (1) Subject to any regulations, the Superintendent may, in writing, order a designated operator to, within a specified period and in accordance with the order, conduct an internal audit of its practices, books and other records to determine whether the designated operator is in compliance with any provision of this Act or the regulations.

• The following provision is not in force.

  Marginal note:Exemption from Statutory Instruments Act

  (2) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

Marginal note:Report

35 The designated operator must comply with the order and provide to the Superintendent, within the period specified in the order, a report of the results of the audit, including, if the designated operator determines that there is non-compliance with any provision of this Act or the regulations, the nature of the non-compliance and any measures that have been taken or will be taken by the designated operator to comply with the provision.

Marginal note:Power to order termination of contravention

• The following provision is not in force.

  36 (1) If the Superintendent believes on reasonable grounds that there is or is likely to be a contravention of any provision of this Act or the regulations, the Superintendent may order a designated operator to

  • The following provision is not in force.

    (a) stop doing something that is or is likely to be in contravention of that provision or cause it to be stopped; or

  • The following provision is not in force.

    (b) take any measure that is necessary in order to comply with the requirements of that provision or to mitigate the effects of non-compliance.

• The following provision is not in force.

  Marginal note:Time and manner

  (2) The order must specify the time within which and the manner in which the designated operator may request a review of the order by the Superintendent.

• The following provision is not in force.

  Marginal note:Exemption from Statutory Instruments Act

  (3) An order made under subsection (1) is exempt from the application of the Statutory Instruments Act.

Marginal note:Compliance with order

• The following provision is not in force.

  37 (1) A designated operator that is subject to an order made under section 36 must comply with it.

• The following provision is not in force.

  Marginal note:Notification of compliance

  (2) Once the designated operator complies with the order, it must notify the Superintendent, without delay, of its compliance.

Marginal note:Request for review

• The following provision is not in force.

  38 (1) An order that is made under section 36 must be reviewed by the Superintendent at the written request of the designated operator that is subject to the order.

• The following provision is not in force.

  Marginal note:Contents and time for making request

  (2) The request must be made within the time and in the manner specified in the order and state the grounds for review and set out the evidence that supports those grounds.

• The following provision is not in force.

  Marginal note:Order in effect

  (3) The order continues to apply during a review unless the Superintendent decides otherwise.

Marginal note:Decision on completion of review

• The following provision is not in force.

  39 (1) On completion of a review, the Superintendent must confirm, amend, revoke or cancel the order and provide notice of the decision to the designated operator and the reasons for it.

• The following provision is not in force.

  Marginal note:Deemed decision

  (2) If the Superintendent does not make a decision in respect of the request within 90 days after the day on which the request is received, or within any further period that is agreed on by the Superintendent and the designated operator, the Superintendent is deemed to have confirmed the order.

Marginal note:Designation of inspectors

• The following provision is not in force.

  40 (1) The Minister of Industry may designate persons or classes of persons as inspectors for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations.

• The following provision is not in force.

  Marginal note:Certificate of designation

  (2) Each inspector must be provided with a certificate of designation in a form established by the Minister of Industry and, when entering any place under subsection 41(1), must, on request, produce the certificate to the person in charge of the place.

Marginal note:Authority to enter place — inspector

• The following provision is not in force.

  41 (1) Subject to subsection 42(1), the inspector may, for the purpose of verifying compliance or preventing non-compliance with any provision of this Act or the regulations, enter a place, including a conveyance, in which they have reasonable grounds to believe that an activity regulated under this Act is being conducted or any document, information or thing that is relevant to that purpose is located.

• The following provision is not in force.

  Marginal note:Powers of entry

  (2) For the purpose referred to in subsection (1), the inspector may

  • The following provision is not in force.

    (a) examine anything in the place;

  • The following provision is not in force.

    (b) use any cyber system, or cause it to be used, for the purpose of examining, among other things, any information contained in or available to it;

  • The following provision is not in force.

    (c) prepare a document, or cause one to be prepared, based on the information;

  • The following provision is not in force.

    (d) examine any record, report, data or other document and make copies of it or take extracts from it;

  • The following provision is not in force.

    (e) use any copying equipment in the place or cause it to be used; and

  • The following provision is not in force.

    (f) remove any document, record or cyber system, or a portion of it, from the place for the purpose of examining it or copying it.

• The following provision is not in force.

  Marginal note:Return of document, record or cyber system

  (3) If the inspector removes any document, record or cyber system referred to in paragraph (2)(f), the inspector must return it to its owner or the person in charge of it, on completion of the examination or copying.

• The following provision is not in force.

  Marginal note:Duty to assist

  (4) Every owner or person in charge of a place that is entered by the inspector and every person found in the place must give the inspector all reasonable assistance to enable the inspector to exercise the inspector’s powers or perform the inspector’s duties and functions under this Act and provide that inspector with any document or information, or access to any data, that the inspector may reasonably require.

• The following provision is not in force.

  Marginal note:Persons accompanying

  (5) The inspector may be accompanied by any other person that the inspector believes is necessary to help the inspector exercise the inspector’s powers or perform the inspector’s duties and functions under this section.

• The following provision is not in force.

  Marginal note:Entering private property

  (6) The inspector and any person accompanying the inspector may enter and pass through private property, other than a dwelling-house on that property, in order to gain entry to a place referred to in subsection (1).