Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.
On July 1, 2026, two new regulations under Ontario's Enhancing Digital Security and Trust Act, 2024 (EDSTA) came into force: O. Reg. 51/26, which sets cyber security governance requirements for a broad slice of the province's public sector, and O. Reg. 52/26, which adds new transparency obligations for school boards handling student data. If your organization is a school board, a college of applied arts and technology, a university, a children's aid society, a Group A, B or C public hospital, or the University of Ottawa Heart Institute, O. Reg. 51/26 is now a live compliance obligation — not a proposal. School boards carry O. Reg. 52/26 as well.
Who is caught by O. Reg. 51/26
The regulation applies to what it calls "prescribed public sector entities" (O. Reg. 51/26, s. 2) — a closed list of five categories: educational institutions as defined in the Freedom of Information and Protection of Privacy Act (colleges of applied arts and technology and universities), public hospitals graded Group A, B, or C under the Public Hospitals Act, the University of Ottawa Heart Institute by name, children's aid societies, and school boards. If your organization falls into one of these categories, the cyber security governance clock started on July 1.
What O. Reg. 51/26 actually requires
- A named primary point of contact and alternate (s. 4). Each prescribed entity must designate a primary point of contact and an alternate, both of whom must hold a senior management position with real decision-making authority over cyber security. The primary contact communicates with the Ministry and approves the entity's cyber security maturity assessment summaries.
- Recurring maturity assessments (s. 5). Entities must complete an initial cyber security maturity assessment within one year of the day the regulation first applies to them, then a further assessment no later than the second anniversary of that initial assessment — and at least once every two years after that. For an entity to which the regulation applied on July 1, 2026, that puts the first assessment due July 1, 2027. Not a one-time exercise. A summary of each assessment, approved by the primary point of contact, must go to the Ministry's Chief Information Security Officer within 30 business days of completion (s. 6).
- 72-hour critical incident reporting (s. 7). A confirmed critical cyber security incident must be reported to the Ministry's Chief Information Security Officer as soon as reasonably practical, and no later than 72 hours after the entity confirms the incident occurred. The clock starts at confirmation, not first detection — which assumes you already have a confirmation process in place before an incident hits.
Who is caught by O. Reg. 52/26 — and what changes for school boards
O. Reg. 52/26 applies to every school board in Ontario (s. 2). It is a notice rule: a board must give notice when personal digital information about a student under 18 enrolled in one of its schools will be disclosed to a third-party owner or operator of a software application the board uses to carry out its duties under the Education Act, or has purchased or otherwise acquired for students' use (ss. 4(1), 5(1)) — the edtech and SaaS tools used in classrooms.
The regulation draws a clear age line on who gets the notice: for students under 16, the notice goes to a parent or guardian (s. 4); for students 16 and 17, the notice goes to the student directly (s. 5). The notice itself has to set out the specific elements of personal digital information being disclosed, the legal authority and purpose for the disclosure, the name of the software application and its owner or operator, the title and business contact details of an individual the board has authorized to answer questions, and a statement explaining the rights of a student (and, for students under 16, of a parent or guardian) who thinks the information has been improperly collected, used, retained or disclosed — not just a generic privacy policy link. The notice must be in writing, and given as early in the school year as is operationally feasible (ss. 4(3), 5(3), 6).
Why this matters beyond the named entities
If you are a software vendor selling into Ontario's broader public sector — school information systems, hospital administrative tools, case management platforms for children's aid societies — your customers just inherited new obligations that flow back to you. Expect new contract language, new data-disclosure questions, and new urgency around documenting exactly what personal information your platform touches and why.
What to do before your next audit cycle
- Confirm whether your organization is a "prescribed public sector entity" under O. Reg. 51/26 — don't assume; the list is specific.
- Name the primary cyber security point of contact and an alternate now, if you haven't, and send their names, titles and contact details to the Ministry's Chief Information Security Officer; changes must be reported within 10 business days (s. 4(4)). This is a named-person requirement, not a committee.
- Build (or confirm) the incident-confirmation process that makes a 72-hour reporting clock achievable.
- School boards: inventory every software provider receiving student personal information, and check your notice process against the under-16 / 16-17 split.
How Mosaic helps
This is exactly the kind of regulatory-mapping-to-operations problem our practice is built for. Mosaic's approach to public-sector work follows a proprietary, standardized methodology: we map the prescribed-entity question against your actual structure, build the evidence trail a regulator expects to see, and hand your team a governance model that survives beyond one compliance cycle — expert-led, with a named senior practitioner behind every finding.