Statement: CLHIA applauds CCIR's Position Paper on harmonization of cyber incident reporting frameworks

News Release

(Toronto, May 27, 2025) Stephen Frank, President and CEO of the Canadian Life and Health Insurance Association (CLHIA) issued a statement on the Canadian Council of Insurance Regulators (CCIR) position paper on the Harmonization of Incident Reporting Frameworks:

Canada’s life and health insurers welcome CCIR's release of recommendations for greater harmonization in cyber incident reporting requirements.

Managing and mitigating cyber security incidents continues to be a key focus for financial institutions, which are increasingly leveraging technology to provide the best service possible to their customers.

Prompt reporting of cyber security incidents is important for regulators’ management of an information security incident and allows them to exercise their consumer protection mandate. However, differences in reporting requirements across Canada can duplicate efforts and create undue burden at a time when companies are focused on addressing the incident.

The position paper represents important guidance from the CCIR, which plays a critical role in promoting an efficient and effective insurance regulatory system in Canada. Greater collaboration and efficient information sharing between governments and regulators during a cyber incident are in the best interest of consumers.

Our members look forward to working collaboratively with the CCIR and Canadian federal regulators to harmonize how cyber security incidents are reported.

About the CLHIA
The CLHIA is a voluntary association whose member companies account for 99 per cent of Canada’s life and health insurance business. These insurers provide a wide range of financial security products including life insurance, annuities (including TFSAs, RRSPs, RRIFs and pensions) and supplementary health insurance to nearly 30 million Canadians. They hold over $1 trillion in assets in Canada and employ almost 180,000 Canadians.