Cybercrime Law in Canada
Canada prosecutes computer crime under its federal Criminal Code, with privacy governed separately.
Key laws
- Criminal Code, s 342.1 — unauthorized use of a computer: fraudulently and without colour of right obtaining a computer service, intercepting a computer function, using a computer system to commit those offences or mischief to computer data, or dealing in computer passwords that would enable them. Punishable by up to 10 years on indictment.
- Criminal Code, s 430(1.1) — mischief in relation to computer data: wilfully destroying or altering computer data, rendering it meaningless, useless or ineffective, or obstructing or denying lawful access to it.
- Criminal Code, s 184 — interception of private communications, subject to the exceptions in s 184(2) (consent, lawful authority, network operation and network-security purposes).
- PIPEDA (Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5) — private-sector privacy, including mandatory reporting of breaches of security safeguards. Proposed replacement legislation (Bill C-27, the Digital Charter Implementation Act, 2022) did not pass in the 44th Parliament, so PIPEDA remains the operative federal statute.
Enforcement
The Royal Canadian Mounted Police (RCMP), including the National Cybercrime Coordination Centre, investigates; the Canadian Centre for Cyber Security leads national cyber defence; and the Office of the Privacy Commissioner of Canada oversees PIPEDA. Several provinces have their own substantially similar private-sector privacy laws.
Plain-language overview, not legal advice. Laws change — read the primary sources linked above and consult a qualified lawyer for any specific question.
Sources verified 9 August 2026 against the Justice Laws Website (laws-lois.justice.gc.ca).