Update 2026-09-22: Parliament resumed on 2026-09-21 with Bill C-36 still at first reading. See where Bills C-36 and C-8 stand this fall.
On 2026-06-15, the Minister of Artificial Intelligence and Digital Innovation tabled Bill C-36, which would enact the Protecting Privacy and Consumer Data Act (PPCDA) (Gowling WLG). It is the third attempt to modernize PIPEDA, the federal private-sector privacy law, after Bill C-11 (2020) and Bill C-27 (2022). Both died when Parliament was dissolved or prorogued.
The bill would replace Part 1 of PIPEDA, which governs how businesses collect, use and disclose personal information (bill text).
What the bill proposes
- Consent, with clearer exceptions. Consent remains the base rule, with expanded exceptions for defined business activities and legitimate interests (Osler).
- Stronger protection for children’s information. Organizations would have to meet a higher standard for minors’ data, and the regulator must consider the best interests of children (DLA Piper).
- New individual rights: disposal (deletion or anonymization) and data mobility.
- Automated decision systems. Transparency obligations for systems that could have a legal or similarly significant effect on individuals. See automated decisions under Law 25 and Bill C-36.
- De-identified and anonymized information would be expressly addressed.
- A mandatory privacy management program.
- Service providers and cross-border transfers. Codified service provider rules and a new privacy impact assessment before personal information is disclosed or transferred outside Canada (Osler).
Enforcement
- A new regulator. The bill would expand the Digital Safety Commission created under the proposed Safe Social Media Act (Bill C-34) into the Digital Safety and Data Protection Commission of Canada. The separate tribunal proposed in Bill C-27 is dropped (DLA Piper).
- Administrative penalties up to the higher of $10 million or 3% of gross global revenue, and fines for offences up to the higher of $25 million or 5% (Osler).
- A private right of action for individuals affected by a contravention.
What it means today
Nothing changes yet. The bill must pass both Houses, its coming into force depends on Bill C-34, and the government would fix the date by order (DLA Piper). Commentators expect years before obligations apply.
But much of what C-36 proposes already applies in Quebec under Law 25: privacy governance, impact assessments for transfers outside the province, automated decision transparency and data portability. Organizations that comply with Law 25, and with the GDPR in Europe, will have less to change. See three Law 25 obligations businesses still miss and assessing cloud and SaaS transfers under section 17.
The government’s announcement presents the bill as part of a broader update of privacy protection for the digital age. We will update this insight as the bill progresses. Accel GRC helps organizations build the privacy management program the bill would require. Questions? Talk to us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult