Compliance guide
Ontario and federal rules, in plain language
Privacy, accessibility, employment, payments, defence and public-sector cyber rules, and what LRJ can do about the technology side.
This guide is general information, not legal advice. LRJ fixes the technology; your lawyer, accountant or HR adviser owns your policies. Last verified: November 6, 2026.
AODA basics
Ongoing- Who
- Every Ontario business and non-profit with 1 or more staff
- What you must do
- Accessible customer service policies; staff and volunteer training on the Human Rights Code and accessible customer service; an accessible way to give feedback; accessible formats on request; accessible employment practices.
- How LRJ helps
- Website DevelopmentAccessible websites and document templates.
AODA compliance report
Next report due December 31, 2026- Who
- Organizations with 20 or more staff
- What you must do
- File an accessibility compliance report online every three years. Penalties reach $100,000 a day for corporations and $50,000 a day for directors and officers.
- How LRJ helps
- A reminder only; filing the report is not an LRJ service.
AODA websites and documentation
Now- Who
- Organizations with 50 or more staff
- What you must do
- Public websites and web content created or significantly refreshed after January 1, 2012 must meet WCAG 2.0 Level AA. You also need documented accessibility policies, a multi-year accessibility plan posted online and reviewed every 5 years, training records, individual accommodation plans and a return-to-work process. Ontario is expected to move to WCAG 2.2 around 2027.
- How LRJ helps
- Website DevelopmentWebsite Development and the Accessible Web Refresh bundle, built to WCAG 2.2.
Bill C-8 (Critical Cyber Systems Protection Act)
Phased- Who
- Designated operators in finance, telecommunications, energy and transportation. Their suppliers should expect requirements to flow down.
- What you must do
- Royal assent June 16, 2026, with phased implementation. Suppliers can expect security questionnaires and contract terms from designated operators.
- How LRJ helps
- Security AssessmentManaged Security Services
CASL (anti-spam)
Every send- Who
- Anyone sending commercial email
- What you must do
- Get consent, identify the sender, and include a working unsubscribe. Registered charities' fundraising emails are exempt from the consent and unsubscribe rules; gift-shop sales, sponsor promotions and emails from unregistered non-profits are not. Implied consent from a donation, volunteering or membership lasts 2 years. Penalties reach $10 million per violation for organizations.
- How LRJ helps
- Website DevelopmentCASL-ready website forms and CRM consent fields.
CPCSC (defence supplier cyber certification)
Contract by contract- Who
- Defence suppliers handling protected information
- What you must do
- Level 1 (13 controls, self-assessed) has applied since April 1, 2026. Level 2 (98 controls, third-party audit) phases in from spring 2027. Level 2 aligns with Canada's ITSP.10.171 and the US NIST SP 800-171 standard behind CMMC.
- How LRJ helps
- CPCSC Contract-Ready AssessmentSecure ModernizationManaged Compliance ServicesTraining WorkshopsLRJ prepares you for assessment. It is not a certification body and does not certify anyone.
CRA records
Ongoing- Who
- Every business, and registered charities
- What you must do
- Businesses keep records for 6 years from the end of the last tax year they relate to, including electronic records such as accounting and point-of-sale data, at a Canadian place of business unless the CRA agrees otherwise. Charities keep financial records, source documents and T3010 copies for 6 years, donation receipt copies for at least 2 years, and governing documents and minutes while registered plus 2 years after revocation, at a Canadian address on file with the CRA.
- How LRJ helps
- Data Backup & Disaster RecoveryManaged Cloud
Cyber insurance
At renewal- Who
- Anyone with a cyber-insurance policy
- What you must do
- Insurers increasingly expect phishing-resistant multi-factor sign-in (number matching at minimum; passkeys or FIDO2 for email, VPN and admin accounts), endpoint detection and response, unalterable and tested backups, at least yearly training with phishing simulations, email security (DMARC), separate privileged accounts, patching of known vulnerabilities, and an incident response plan tested in the last 12 months. Inaccurate answers on the application can lead to a denied claim.
- How LRJ helps
- Managed IT ServiceManaged Security ServicesData Backup & Disaster RecoveryTraining WorkshopsThe Insurance-Ready Basics bundle.
CyberSecure Canada (optional)
Voluntary- Who
- Small and medium organizations that choose to certify
- What you must do
- A voluntary federal certification: 13 baseline security controls from the Canadian Centre for Cyber Security, audited by an accredited certification body. The mark is valid for 2 years.
- How LRJ helps
- Security AssessmentManaged Security ServicesLRJ prepares you; it doesn't certify.
Ontario public-sector cyber rules (Bill 194 / EDSTA)
In force since July 1, 2026- Who
- Children's aid societies, school boards, colleges, universities and many public hospitals, and their suppliers
- What you must do
- A cyber security program meeting set minimums; a named senior leader accountable for cyber security and the Ministry's main contact; cyber security maturity assessments using Ministry-endorsed standards (the first is due one year after the rules apply, with a summary to the Ministry within 30 days); critical cyber security incidents reported to the Ministry within 72 hours of confirmation. Related rules cover digital information about people under 18.
- How LRJ helps
- Security AssessmentManaged Security ServicesManaged Compliance ServicesTraining WorkshopsThe Children's Aid Cyber Program.
Job posting rules (ESA)
In force since January 1, 2026- Who
- Employers with 25 or more employees
- What you must do
- Disclose any AI used to screen, assess or select applicants; state the expected pay or pay range (a range no wider than $50,000; not required above $200,000); say whether the vacancy exists; no Canadian-experience requirements; keep postings and application forms for 3 years.
- How LRJ helps
- Private AI Build & HostingTraining WorkshopsManaged IT ServicePrivate AI governance, training, and retention settings in Managed IT.
Electronic monitoring policy (ESA)
In place before March 1 each year- Who
- Employers with 25 or more employees on January 1. People are counted, not full-time equivalents; all Ontario locations count together, and related employers may count together.
- What you must do
- A written policy saying whether staff are monitored electronically, how and in what circumstances, for what purposes, the date it was prepared and the dates it changed. Give copies to existing staff within 30 days and to new staff within 30 days of starting. Keep it for 3 years after it stops applying.
- How LRJ helps
- Managed IT ServiceLRJ provides a list of every monitoring tool it runs, so HR can write an accurate policy.
PCI DSS v4.0.1 (card payments)
Since March 31, 2025- Who
- Anyone taking card payments
- What you must do
- The newer requirements became mandatory on March 31, 2025. They include weekly tamper detection on online payment pages (requirements 6.4.3 and 11.6.1 for SAQ A, SAQ A-EP and SAQ D merchants), and SAQ A merchants now need vulnerability scans.
- How LRJ helps
- Managed Security ServicesWebsite Development
PHIPA (health information)
Breach statistics due by March 1 each year- Who
- Health information custodians: clinics, hospices, community health centres and other health providers
- What you must do
- Tell patients about theft, loss or unauthorized use or disclosure at the first reasonable opportunity. Tell the Information and Privacy Commissioner of Ontario in set cases, including theft of records that weren't de-identified or encrypted. File annual breach statistics by March 1. Report to a regulatory college within 30 days in certain discipline cases. Fines reach $1 million for organizations and $200,000 for individuals.
- How LRJ helps
- Managed Security ServicesData Backup & Disaster RecoveryThe Clinic Privacy Pack.
PIPEDA (privacy)
Ongoing- Who
- Organizations handling personal information in commercial activity. Non-profits are covered only for commercial activity outside their mandate, such as selling or renting donor lists.
- What you must do
- Safeguard personal information. Report breaches that pose a real risk of significant harm to the Privacy Commissioner of Canada and notify the people affected. Keep a record of every breach for 24 months.
- How LRJ helps
- Managed Security ServicesData Backup & Disaster RecoverySecurity Assessment
Start here
Not sure where you stand?
A fixed-price assessment lists the rules that apply to you and what to fix first.