Canada: Ontario iGaming security requirements
Ontario's iGaming operators and gaming-related suppliers must manage IT under a recognized industry framework, monitor and assess their security regularly, and report security and data breach incidents immediately under the AGCO's notification matrix. Federal privacy law adds a duty to report breaches with a real risk of significant harm.
The AGCO Registrar's Standards
The Registrar's Standards for Internet Gaming came into force on 4 April 2022; the AGCO's page was last updated in May 2026. Section 5, Information Technology, sets the security requirements.
| Standard | Requirement |
|---|---|
| 5.01 | "A recognized industry standard framework shall be used to manage the information technology (IT) control environment". Also applies to gaming-related suppliers. |
| 5.09 | Gaming systems, infrastructure, data and logs protected from threats and attacks; "The appropriateness and effectiveness of steps taken to harden technology components shall be regularly assessed." |
| 5.10 | Security events logged, monitored, promptly analyzed and escalated, including intrusion detection. |
| 5.11 | "Independent assessments shall be regularly performed by a qualified individual to verify the adequacy of gaming system" security. |
| 5.12 | "Operators and gaming related suppliers must inform themselves of the current threats and risks"; suppliers must warn customers of material threats. |
| 5.28 | Documented procedures for IT operations and incident management. |
| 5.37 | "Encryption algorithms and key lengths shall be regularly assessed for security vulnerabilities." |
| 5.48 | "Inappropriate use of administrator accounts shall be reported to the Registrar in accordance with the notification matrix." |
Two points to note. ISO/IEC 27001 is not named; any recognized framework can satisfy 5.01. And penetration testing is not explicitly required; 5.09 and 5.11 come closest, and no assessment frequency is set beyond "regularly".
Notification matrix
The AGCO's Internet Gaming Notification Matrix (version 1.6, dated May 14, 2026) defines "Immediate" as submission "as soon as the situation is identified within reason and without delay".
| Row | Event | Deadline | Report to |
|---|---|---|---|
| I1 | Problems with the integrity or security of the gaming system; data breach of sensitive data | Immediate | AGCO, through the iAGCO portal (Standards 1.13, 4.09) |
| I2A | Suspicious behavior, cheating at play and unlawful activity, excluding money laundering; personal information must be left out of the submission | Immediate | AGCO, through iAGCO (optional for iGaming Ontario; Standards 4.19, 6.01) |
| I6 | Unplanned closure of an internet gaming site or the self-exclusion registry | Immediate | AGCO |
| I7 | Inappropriate use of administrator accounts | Monthly | AGCO |
Federal privacy: PIPEDA
Under PIPEDA section 10.1, an organization must report to the Privacy Commissioner any breach of security safeguards involving personal information under its control "if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual", "as soon as feasible after the organization determines that the breach has occurred", and notify affected individuals on the same test. The Breach of Security Safeguards Regulations require a record of every breach to be kept for 24 months.
Questions about Ontario iGaming security
Does Ontario require ISO 27001 for iGaming operators?
Not by name. AGCO standard 5.01 requires a recognized industry standard framework to manage the IT control environment; ISO/IEC 27001 is one option.
How fast must an Ontario operator report a data breach?
Immediately, to the AGCO through its iAGCO portal, under row I1 of the AGCO notification matrix. iGaming Ontario is one of the registrants the row applies to, not the recipient. If personal information is involved and there is a real risk of significant harm, PIPEDA also requires a report to the Privacy Commissioner as soon as feasible.
Sources
- AGCO, Registrar's Standards for Internet Gaming; Internet Gaming Notification Matrix v1.6
- PIPEDA s.10.1; Breach of Security Safeguards Regulations (SOR/2018-64)
- All sources checked 24 October 2026.