Ontario Updates Cybersecurity and Privacy Framework for Modern Challenges

On March 13, 2026, Ontario announced a significant update to its privacy and cybersecurity framework, the first major revision in nearly 40 years. The reforms aim to enhance the protection of personal and sensitive data, particularly for children, and to modernize the province's technology practices. Key changes include improved controls over employee and client data, and the ability for information in employee accounts to transfer seamlessly between public sector roles. The update also revises Freedom of Information (FOI) rules, specifically excluding records from the premier and cabinet ministers from the Freedom of Information and Protection of Privacy Act. These changes are expected to impact HR leaders across various public sectors, including hospitals and educational institutions, necessitating new compliance and training measures. The government emphasizes that the outdated framework posed unnecessary privacy risks and that these updates are essential for responsible governance in the digital age.

Key Points: • Ontario is modernizing its privacy and cybersecurity framework for the first time in 40 years. • The updates will enhance data protection, particularly for children's information. • New FOI rules will exclude records from cabinet ministers, impacting transparency.