Parliament is back: where Bills C-36 and C-8 stand, and what to do this fall

The House of Commons returned on 2026-09-21. Two federal bills matter to anyone who handles personal information or supplies critical infrastructure: Bill C-36 on privacy, and Bill C-8 on cyber security. One is law, one is not. Here is where each stands and what is worth doing this fall.

Bill C-36: still at first reading

Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on 2026-06-15 and returns this fall having completed only first reading (Gowling WLG). It must still pass second reading, committee study and third reading in the House, then the same stages in the Senate (PPC Land). Even after royal assent, it would come into force on a date set by order, and much of its detail depends on regulations not yet drafted.

Its predecessors, Bills C-11 and C-27, both died before royal assent. That history argues for preparing in proportion: build what is useful under any version of the law, and wait on the rest. Our overview of Bill C-36 covers what it proposes.

Bill C-8: law, awaiting activation

Bill C-8 received royal assent on 2026-06-15 (Digital Policy Alert). The Critical Cyber Systems Protection Act it enacts will apply once the government brings it into force, designates classes of operators and adopts regulations (BLG). See what the Act changes, and when.

What to do this fall

For privacy (C-36, and Law 25 already in force)

• Privacy management program. Both C-36 and Quebec’s Law 25 expect documented governance: a person responsible, policies, training and records.
• Transfers outside Canada. C-36 would add an impact assessment before personal information leaves Canada. Law 25 already requires one before it leaves Quebec. See assessing cloud and SaaS transfers.
• Automated decisions. Inventory the systems that make or support decisions about people. See automated decisions under Law 25 and Bill C-36.
• Deletion and portability. Know where personal information lives and how you would export or delete one person’s data on request.

For cyber security (C-8)

• If you could be designated: gap-assess your cyber security program and your ability to report a significant incident within 72 hours.
• If you supply banks, telecoms, payment networks or energy companies: expect contract changes and evidence requests. Prepare a reusable evidence pack and an independent report. See OSFI B-10 for suppliers.

We will keep tracking

We follow both files and update our insights as they move. Accel GRC helps organizations build one program that answers Law 25, C-36 and C-8 together. Contact us to review where you stand.

Sources

• PPC Land: Canada's Bill C-36 sets $10 million privacy fines as Parliament returns (2026-09-19)
• Gowling WLG: Bill C-36, timeline of developments
• Digital Policy Alert: Bill C-8 received royal assent
• BLG: Bill C-8 adopted, Critical Cyber Systems Protection Act
• Parliament of Canada, LEGISinfo: Bill C-36 (45-1)