Does Ontario's Bill 194 Apply to Nonprofits?

Does Bill 194 apply to nonprofits? Not because they are nonprofits. Ontario's Bill 194 applies to public sector entities, and nonprofit status is not the test. Several covered bodies are nonprofit corporations, such as children's aid societies, public hospitals and universities. A typical community charity or association is not covered directly. It may still feel the effects through funding agreements and contracts with covered bodies.

What Bill 194 is

Bill 194 received Royal Assent on November 25, 2024, as the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024. It has two schedules that do different jobs:

• Schedule 1 enacts the Enhancing Digital Security and Trust Act, 2024 (EDSTA). It gives the province authority to set cyber security requirements, artificial intelligence requirements and rules about digital information on people under 18, for public sector entities. Most of the detail is in regulations.
• Schedule 2 amends the Freedom of Information and Protection of Privacy Act (FIPPA), adding a duty to safeguard personal information, privacy impact assessments, and breach reporting to the Information and Privacy Commissioner of Ontario.

People still call the whole thing "Bill 194," which is why procurement documents and funder letters use that name. For the vendor view of the same law, see our guide to Ontario Bill 194 for vendors.

Who counts as a public sector entity

The EDSTA applies to public sector entities. The Act describes these by reference to Ontario's two access and privacy statutes, plus two named additions:

• Institutions under FIPPA: provincial ministries, agencies, boards and commissions, plus colleges, universities and hospitals.
• Institutions under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA): municipalities and local boards such as police services boards and some conservation and transit bodies.
• Children's aid societies.
• School boards.

Look at that list again with the nonprofit question in mind. Children's aid societies are typically incorporated as nonprofit corporations. Ontario's public hospitals and universities are not-for-profit organizations. They are covered because of what they are in law, not because of their tax status. A nonprofit that is not on this list, such as a food bank, an arts organization, a sports association or a community services charity, is not a public sector entity under the EDSTA.

What is in force now

This is the part most summaries get wrong, because the pieces came into force at different times.

Piece	Who it applies to	Status
FIPPA amendments (Schedule 2): safeguarding duty, privacy impact assessments, breach reporting to the IPC	FIPPA institutions only. Not municipal institutions under MFIPPA.	Most provisions in force since July 1, 2025
O. Reg. 51/26, Cyber Security, under the EDSTA	Prescribed entities: public hospitals in groups A, B and C under the Public Hospitals Act, the University of Ottawa Heart Institute, colleges and universities, school boards, and children's aid societies, including Indigenous child and family well-being agencies	Took effect July 1, 2026
O. Reg. 52/26, Digital Technology Affecting Individuals Under Age 18	School boards	Took effect July 1, 2026
Artificial intelligence requirements under the EDSTA	Public sector entities	No AI regulation in force at the time of writing. Ministries and provincial agencies follow the province's Responsible Use of AI Directive.

Check the e-Laws site before relying on any of this in a contract or a board report, because Ontario can add prescribed entities or new regulations without a new bill.

What the cyber security regulation requires

For the entities it prescribes, O. Reg. 51/26 sets a short list of concrete obligations, according to the province's EDSTA summary page:

• Designate a primary cyber security contact and an alternate, in senior roles with decision-making authority over cyber security, and give their details to the ministry's Chief Information Security Officer.
• Run a cyber security maturity assessment every two years and submit a summary. Legal commentary on the regulation puts the first deadline at July 1, 2027, with the summary due within 30 days of completion.
• Report critical cyber security incidents to the ministry within 72 hours of confirming them.

A children's aid society that is a nonprofit is squarely inside these duties. A community nonprofit that delivers services under contract to that society is not, but it will see the obligations in what the society asks of it.

How Bill 194 reaches nonprofits that are not covered

Most nonprofits that ask this question are not public sector entities. They are service providers, partners or grant recipients of one. That is where the effects arrive.

Through contracts. A covered hospital, school board or children's aid society has to report critical incidents within 72 hours of confirmation and, if it is a FIPPA institution, report privacy breaches to the IPC. If your organization holds or processes its data, the entity needs you to tell it quickly when something goes wrong. Expect incident notification clauses with a clock, security questions, and requests for a description of how you handle its data.

Through privacy impact assessments. A FIPPA institution must complete a privacy impact assessment before collecting personal information through a new programme or system. If your organization is part of that programme, much of the assessment is facts about your handling of the data. Have a plain description of what you collect, where it is stored, who can see it and how long you keep it.

Through student data. If you deliver a programme or software that receives student information from a school board, O. Reg. 52/26 requires the board to tell parents, or students aged 16 and over, what is shared, why, and with which application and vendor. Your organization's name may appear in that notice.

Through funding agreements. Organizations funded by a ministry or a covered agency may see new security or privacy terms in their agreements. Nothing in the Act requires a funder to add them, but it is a common way for an obligation to travel down a funding chain. Read the agreement rather than assuming either way.

Our guide to selling to the Canadian public sector covers the document set public bodies commonly ask suppliers for.

Which privacy laws do apply to an Ontario nonprofit?

If Bill 194 does not cover you directly, other laws may. The answer depends on what you do, not on your corporate form:

• PIPEDA applies to personal information collected, used or disclosed in the course of commercial activity. Many nonprofits' core activities are not commercial, but activities such as selling memberships, lists or services can be. See do I need PIPEDA.
• PHIPA applies if you are a health information custodian or an agent of one, which includes many community health providers. See PHIPA compliance in Ontario.
• Quebec Law 25 may apply to personal information of people in Quebec, depending on the activity.
• Contractual obligations from funders and partners often go further than any statute.

Our guide to which Canadian privacy law applies walks through each test.

What an Ontario nonprofit should do now

Whether or not you are covered, five steps put you in a good position with funders and partners that are:

1. Confirm your status. Are you a FIPPA or MFIPPA institution, a children's aid society, a school board, or a prescribed hospital? If none apply, you are not a public sector entity.
2. List your covered partners. Which hospitals, boards, societies, colleges or ministries share data with you or fund you?
3. Write down your data flows. For each partner, what personal information you receive, where it lives, who can access it and when it is deleted.
4. Set an incident notification process you can meet. Decide who confirms an incident, who calls the partner, and how fast. Test it once with a short tabletop exercise.
5. Read your agreements. Look for new security, privacy and notification clauses at renewal.

None of this requires a large budget. It does require someone to own it. For help structuring incident steps, see building an incident response plan from scratch.

Common questions about Bill 194 and nonprofits

Does Bill 194 apply to charities in Ontario?

Not on the basis of charitable status. The Enhancing Digital Security and Trust Act applies to public sector entities: FIPPA and MFIPPA institutions, children's aid societies and school boards. A charity outside those groups is not covered directly, although partners and funders that are covered may pass security and privacy obligations to it through contracts and funding agreements.

Are children's aid societies covered by Bill 194?

Yes. Children's aid societies are named public sector entities under the Enhancing Digital Security and Trust Act, and O. Reg. 51/26 prescribes them, including Indigenous child and family well-being agencies, for the cyber security requirements that took effect July 1, 2026, such as a designated contact, maturity assessments and reporting critical incidents within 72 hours.

Does Bill 194 apply to hospitals?

Public hospitals are FIPPA institutions, so the Schedule 2 privacy amendments affect them. O. Reg. 51/26 also prescribes public hospitals in groups A, B and C under the Public Hospitals Act, plus the University of Ottawa Heart Institute, for the cyber security requirements. Personal health information they hold remains governed mainly by PHIPA.

Do the Bill 194 FIPPA changes apply to municipalities?

No. The Schedule 2 amendments, including privacy impact assessments and breach reporting to the Information and Privacy Commissioner, apply to institutions under FIPPA. Municipal institutions under MFIPPA were not included in those amendments, although MFIPPA institutions are still public sector entities under the Enhancing Digital Security and Trust Act.

Is there a Bill 194 certification for nonprofits or vendors?

No. The Act does not create any certification or attestation an organization can obtain. Covered entities meet their own obligations and ask partners for evidence such as data flow descriptions, incident notification commitments, and independent assessments like a penetration test or an ISO 27001 certificate.