Cybersecurity Awareness Training for Ontario School Boards: What the New Rules Ask

Ontario School Board Cybersecurity Requirements Under O. Reg. 51/26

Bill 194 created the Enhancing Digital Security and Trust Act, and the Act names school boards. Its cyber security regulation, O. Reg. 51/26, requires every board to have a cyber security program with four parts:

• A named contact. A primary contact and an alternate, both senior managers who can make cyber security decisions. Their details go to the province's Chief Information Security Officer, at the Ministry of Public and Business Service Delivery and Procurement, not the Ministry of Education. Report any change within 10 business days.
• A maturity assessment. The first is due within a year of the rule applying, so by July 1, 2027. An assessment finished in the year before July 1, 2026 can count as the first. After that, at least once every two years.
• A summary to the province. The method, framework, overall score, and areas to improve go to that ministry within 30 business days. Your primary contact approves it.
• A 72-hour report. A critical cyber security incident goes to that ministry within 72 hours after you confirm it.

An incident is critical when it affects the security or availability of your systems or data and has a significant effect. That means it significantly disrupts services, risks public safety, needs a significant recovery effort or your incident response plan, or poses a significant risk to your reputation and public trust.

Is Cybersecurity Awareness Training Required for Ontario School Board Staff?

Not under O. Reg. 51/26. Its eight sections set no training or phishing simulation duty. But the Ministry of Education's 2026-27 memo on mandatory PA Days says all educators should receive cyber awareness training, including how to recognize and prevent phishing, malware, and unauthorized access. The Act also lets the province add education and awareness duties by regulation later. Your own board policy, your insurer, or a contract may ask for training too, so check those.

Phishing Simulation for Ontario School Boards

Simulations teach staff what to report, and a report button makes it one click. In the past few months, staff at schools using Tartan App reported 7,393 real emails. Tartan's AI rated 5,862 of them, and half of those were malicious or suspicious. Schools removed or quarantined 52.6% of all reported emails, pulling them from hundreds of thousands of mailboxes.

If you're setting up the program itself, here's how to run phishing simulations in a school.

Student Data Privacy Requirements: Ontario's Parent Notice Rule

A second regulation, O. Reg. 52/26, also took effect July 1, 2026. It applies to every school board. When a student's personal information goes to a software app the board uses, the board has to give written notice. For a student under 16, the notice goes to a parent or guardian. At 16 and 17, it goes to the student.

Staff-only training that gets no student data falls outside the rule. Student training falls inside it when the vendor gets student names or school email addresses. That includes student cybersecurity training from Tartan App. Plan the notice before you add students.

PIPEDA, MFIPPA and Privacy Requirements for a Training Vendor

PIPEDA, the federal privacy law, generally doesn't cover a school board's core work. The federal privacy commissioner says so. An Ontario school board's records fall under MFIPPA, the municipal privacy act. On top of that, under the Enhancing Digital Security and Trust Act, data a vendor collects, uses, keeps, or shares for your board counts as your board's own handling.

Bill 194 also made privacy impact assessments and breach reporting mandatory under FIPPA, the provincial privacy act. Those rules don't cover school boards, which fall under MFIPPA, but Ontario's privacy commissioner calls them good practice, and boards now ask vendors for a privacy impact assessment.

Regulators already hold boards to that. In November 2025, Ontario's and Alberta's privacy commissioners reported on the December 2024 PowerSchool breach. In Ontario, they looked at the Ministry of Education and 20 school boards. They found gaps at some or all of the educational bodies they investigated. Contracts lacked privacy and security terms. Boards didn't monitor the vendor's safeguards, such as multi-factor authentication and remote support access. Breach plans fell short. So ask any training vendor four questions:

• What privacy and security terms will you sign in the contract?
• Who on your team can reach our data, and do they use multi-factor authentication?
• How will we know your safeguards are still in place next year?
• What's your breach plan, and how fast will you tell us?

A training platform that sends simulations and pulls phishing from inboxes connects to your Google Workspace or Microsoft 365. That's exactly the kind of vendor access these questions are for.

Tartan App for Ontario School Boards

Tartan App is a Toronto company that builds security awareness training only for K-12 schools. Ontario law governs our terms. Our privacy policy lists its subprocessors, and we provide a vendor privacy impact assessment package for a board's review. Multiple Ontario school boards use Tartan.

• Phishing simulations that copy 110+ services schools use, one email per person per cycle at a random time.
• 60+ short training videos that end in a quick quiz.
• Tartan App Shield, the report button for Gmail and Outlook, and Threat Manager, which pulls a reported threat from every mailbox at once.
• Student training for every grade, sold separately.
• Priced per school with unlimited staff, using the school count from federal or provincial government sources, and billed in Canadian or US dollars.

Justin Fagan, Information Technology Manager at Foothills Academy in Calgary, has advice for other schools: "If you are a school without simulated phishing and cyber-security awareness training, you now no longer have any excuses thanks to the product that Tartan App has made available."

See Tartan pricing, or see how Tartan compares in our guide to the best security awareness training for schools.

Ontario School Board Cybersecurity FAQ