Encryption Laws Secria

Encryption lawsCanada

Canada's Bill C-22 and lawful access

Bill C-22 would let Canada's government require electronic service providers to build capabilities that help police and intelligence agencies access information. It passed the House of Commons on 18 June 2026 and is in Senate committee.1, 2

Checked 28 October 2026 against the sources. This page describes a bill. It is not legal advice.

Where the bill stands

C-22 (45th Parliament, 1st session), An Act respecting lawful access. Short title: Lawful Access Act, 2026. Sponsor: the Minister of Public Safety.1

  1. Introduction and first reading in the House of Commons.1
  2. Second reading and referral to committee.1
  3. Committee report, report stage and third reading in the House. First reading in the Senate the same day.1
  4. Second reading in the Senate and referral to committee, where it stands as of 28 October 2026.1

An earlier version of the same Act was Part 15 of Bill C-2, the Strong Borders Act, which is still at second reading in the House, last debated on 17 September 2025.3, 4

What Part 2 would do

Part 2 enacts the Supporting Authorized Access to Information Act, a framework so that electronic service providers "can facilitate the exercise" of access powers under the Criminal Code and the CSIS Act.2

Core providersCabinet can make regulations requiring "core providers", the classes of provider listed in a schedule, to develop and maintain operational and technical capabilities to give authorized persons access.2Section 5.
Ministerial ordersThe Minister can make an order for any electronic service provider, core provider or not, containing anything a regulation could. It lasts up to two years and needs the Intelligence Commissioner's approval.2Section 7.
SecrecyA provider must not disclose what an order contains, or that it is subject to one, except as the Act permits.2Section 14.
Systemic vulnerabilityA provider need not comply where that "would have the effect of requiring the provider to introduce a systemic vulnerability" or of preventing it from fixing one.2Sections 5(5) and 7(5).
DecryptionNothing in the Act compels a provider to decrypt, or to ensure an authorized person can decrypt, information its customer encrypted, "unless the encryption was provided by the electronic service provider" and it holds the means to decrypt.2Section 2(4).
 Bill C-22 as passed by the House of Commons on 18 June 2026, read at parl.ca on 28 October 2026.

The definitions that matter

The bill defines "electronic protection" as "authentication, encryption and any other prescribed type of data protection". A "systemic vulnerability" is one that creates "a credible risk, based on recognized international technical standards", that secure information could be accessed by someone without the right to it, other than a risk limited to the people a warrant covers.2

Law professor Michael Geist argues that because regulations can shape these terms, and orders can come before any regulation, providers could face duties that "would be secret by default".5 The government's case, set out in the bill's purpose clause, is to "ensure that electronic service providers can facilitate the exercise of authorities to access information".2

Questions people ask

Has Bill C-22 passed?

Not yet. It passed the House of Commons on 18 June 2026 and was referred to a Senate committee on 22 October 2026. It has not received Royal Assent.1

Would C-22 ban encryption in Canada?

No. It has a systemic vulnerability exception and a clause saying it does not compel decryption of customer-applied encryption.2

What happened to Bill C-2?

C-2, the Strong Borders Act, is still at second reading in the House of Commons. Its lawful access part now appears in C-22.3, 1

Sources 5
  1. C-22 (45-1), An Act respecting lawful access: status, LEGISinfo, Parliament of Canada. Read 28 October 2026.
  2. Bill C-22, as passed by the House of Commons on 18 June 2026, Part 2: Supporting Authorized Access to Information Act, Parliament of Canada. Read 28 October 2026.
  3. C-2 (45-1), Strong Borders Act: status, LEGISinfo, Parliament of Canada. Read 28 October 2026.
  4. Bill C-2, Strong Borders Act, first reading, summary of Part 15, Parliament of Canada. Read 28 October 2026.
  5. Years of uncertainty: Bill C-22's missing regulations and secret ministerial orders, October 2026, Michael Geist. Read 28 October 2026.

We read the law itself, and every status has a date. How we check