Canada’s third attempt at modernizing federal private-sector privacy law was tabled in June 2026. It is not law yet, but its direction is clear enough to start planning.
- Type
- Federal bill (proposed law)
- Short title
- Protecting Privacy and Consumer Data Act
- Tabled
- 2026-06-15, House of Commons (45th Parliament, 1st session)
- Sponsor
- Minister of Artificial Intelligence and Digital Innovation
- Stage
- Second reading (as of 2026-10-03)
- Status
- Not in force
What it is
Bill C-36 would enact the Protecting Privacy and Consumer Data Act and replace Part 1 of PIPEDA; the electronic-documents parts of PIPEDA would remain. It recognizes privacy as a fundamental right and the best interests of children, requires privacy management programs and impact assessments for higher-risk uses, and adds stronger enforcement.
Why it exists
PIPEDA dates from 2000 and relies on an ombudsman model without administrative penalties. Two earlier reform bills, C-11 (2020) and C-27 (2022), died on the order paper. C-36 is narrower than C-27: it drops the separate tribunal and the artificial-intelligence act.
Who it applies to
If passed, the same organizations as PIPEDA Part 1: private-sector organizations in commercial activity across borders and federally regulated businesses. Quebec businesses would continue to deal mainly with Law 25 for in-province activity.
Authority and enforcement
According to the Office of the Privacy Commissioner, oversight of private-sector privacy would move to a new Digital Safety and Data Protection Commission of Canada, created by the related Bill C-34, with power to issue orders and administrative penalties. Some summaries describe the design differently; the final text will govern.
- 2020-11-17
Bill C-11 (Digital Charter Implementation Act) is introduced; it dies at dissolution in 2021.
- 2022-06-16
Bill C-27 proposes the Consumer Privacy Protection Act, a tribunal and an AI act.
- 2025-01-06
Parliament is prorogued and C-27 dies.
- 2026-06-10
Bill C-34 (Safe Social Media Act) is tabled, creating the commission C-36 relies on.
- 2026-06-15
Bill C-36 is tabled at first reading. The OPC issues a statement the same day.
Systems and tools
- Data mobility (portability) between organizations
- Re-identification controls for de-identified data
- Explanations for automated decisions with significant effects
Processes
- Impact assessments for high-risk uses and cross-border transfers
- A higher standard of care for minors’ information
- Use of a new legitimate-interest exception, with documentation
Governance
- A privacy management program that can be produced to the regulator on request
- Board-level oversight of privacy risk
- Contract and vendor updates once in force
If you do not comply
- As proposed, administrative penalties up to $10 million or 3% of gross global revenue
- As proposed, fines up to $25 million or 5% for the most serious offences
- A private right of action after a contravention is found
- Orders from the new commission
Announced and upcoming changes
- NextSecond reading debate, then committee study in the House, then the Senate.
- Coming into forceNot fixed. Commentators expect obligations to start some time after royal assent, with consultation on the transition to the new regulator.
Status checked 2026-10-03. Dates can move; confirm with the official sources below.
- Bill C-36 on LEGISinfo ↗
- Bill C-34 on LEGISinfo ↗
- OPC statement on Bill C-36 (2026-06-15) ↗
- PIPEDA (current law) ↗
Related insights
Reporting a breach to the Privacy Commissioner: the “real risk of significant harm” test explained
Under PIPEDA, a breach must be reported when it creates a real risk of significant harm. Here is how to weigh sensitivity and probability…
Read the insight →Automated decisions and AI: transparency duties under Law 25 (s. 12.1) and what Bill C-36 proposes
Law 25 already requires notice, explanations and human review for fully automated decisions. Bill C-36 proposes similar federal rules. What applies now and how…
Read the insight →Canada’s EU adequacy status and why PIPEDA reform matters to exporters
Canada's EU adequacy status lets European data flow to Canadian businesses with fewer hurdles. It covers PIPEDA only, and federal reform under Bill C-36…
Read the insight →