Public sector entity
Institutions and bodies in Ontario's public sector covered by EDSTA.
How the laws define this
Both the Enhancing Digital Security and Trust Act, 2024 and the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 establish a shared core scope for public sector entities by encompassing institutions defined under the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), alongside school boards and children's aid societies. Additionally, both instruments align by excluding the Legislative Assembly. The primary divergence between the two instruments lies in how they describe the obligations imposed on covered entities. The Enhancing Digital Security and Trust Act, 2024 explicitly details that entities are subject to cybersecurity, AI, and privacy requirements, while the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 broadly subjects them to the Act's new obligations. Furthermore, the former specifically names the Legislative Assembly of Ontario in its explicit exclusion.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Ontario, Canada | Enhancing Digital Security and Trust Act, 2024 | In Force | Explicitly excludes the Legislative Assembly of Ontario from the public sector entities covered, while including institutions under FIPPA and MFIPPA, children's aid societies, and school boards. |
| Canada | Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 | In Force | Omits explicit exclusion of the Legislative Assembly but otherwise mirrors the first by covering FIPPA and MFIPPA institutions, children's aid societies, and school boards. |
What it triggers
- Under the Enhancing Digital Security and Trust Act, 2024, in Ontario, Canada, these entities are subject to the Act's cybersecurity, AI, and privacy requirements.source
- Under the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, in Canada, these entities are subject to the Act's new obligations on cybersecurity, privacy, and responsible AI use.source
Definitions (2)
Defined by the Act to include institutions within the meaning of the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), children's aid societies, and school boards, while explicitly excluding the Legislative Assembly of Ontario. These entities are subject to the Act's cybersecurity, AI, and privacy requirements.
Institutions within the meaning of FIPPA (excluding the Legislative Assembly), institutions under MFIPPA, children's aid societies, and school boards, subject to the Act's new obligations.
Not to be confused with
Public body refers more broadly to government departments, agencies, educational bodies, and local government bodies subject to the Act, without specifying exclusions or exact institutions like FIPPA and MFIPPA.
Questions and answers
What public sector entities are covered by Ontario's EDSTA?
Public sector entities include institutions under FIPPA and MFIPPA, children's aid societies, and school boards, excluding the Legislative Assembly of Ontario. They must comply with cybersecurity, AI, and privacy requirements.
Does the Legislative Assembly count as a public sector entity under these Acts?
No, the Enhancing Digital Security and Trust Act, 2024 explicitly excludes the Legislative Assembly of Ontario.
What obligations apply to public sector entities in these Ontario Acts?
Entities face cybersecurity, privacy, and responsible AI use obligations under both Acts.
Related Terms
Public Body
Government departments, agencies, educational bodies, and local government bodies subject to the Act....
Public entity
Arkansas state or local government bodies covered by the law....
Public‑sector AI
AI systems deployed by federal agencies to deliver or improve public services....
Public-sector AI
AI systems deployed by federal agencies to deliver or improve public services....
Public-sector solution
AI tools procured, developed, or used by public authorities....