Canada is on its third attempt to replace the privacy part of PIPEDA. Bill C-11 died in 2021. Bill C-27, with its Consumer Privacy Protection Act (CPPA), died in January 2025. On June 15, 2026, the government tabled Bill C-36, which would enact the Protecting Privacy and Consumer Data Act (PPCDA).
C-36 keeps much of what the CPPA proposed and changes how it would be enforced. For organizations, the practical question has not moved: what to do while the law is still in Parliament. This article covers where things stand, what C-36 would change, and the preparation that holds up whatever the final text says.
About this update
Where things stand
PIPEDA is still the law. It continues to govern how private-sector organizations collect, use and disclose personal information in the course of commercial activity, except where a substantially similar provincial law applies.
Bill C-36 is early in the process. At the time of writing it has passed first reading in the House of Commons and has not yet been debated at second reading. It still has to go through committee study, third reading and the Senate, and it may be amended along the way. Much of the operational detail will be set by regulation, and obligations may take time to come into force even after Royal Assent.
Other rules already apply. Quebec's Law 25 is fully in force and sets a higher bar than PIPEDA for organizations handling Quebec residents' information. GDPR applies to organizations that offer goods or services to, or monitor, individuals in the EU. Public-sector institutions fall under public-sector privacy laws (in Ontario, FIPPA and MFIPPA) rather than PIPEDA or C-36.
What Bill C-36 would change
The comparison below reflects the bill as tabled.
| Area | PIPEDA today | Bill C-36 (PPCDA) as tabled |
|---|---|---|
| Regulator | The Office of the Privacy Commissioner investigates and makes recommendations, but cannot issue binding orders or penalties on its own | A new Digital Safety and Data Protection Commission of Canada, with a Privacy and Consumer Data Commissioner who investigates and can issue binding compliance orders |
| Penalties | Fines of up to $100,000 for certain offences | Administrative monetary penalties up to the greater of $10 million or 3% of gross global revenue; fines for the most serious offences up to the greater of $25 million or 5% |
| Consent | Meaningful consent, express or implied depending on sensitivity and reasonable expectations | Express consent as the default, implied where appropriate, plain-language explanations required. Exceptions for certain business activities and for a legitimate interest backed by a documented assessment. Neither exception applies where the purpose is to influence the individual's behaviour or decisions |
| Accountability | Accountability principle; designate someone responsible | A documented privacy management program, scaled to the volume and sensitivity of information, producible to the Commission on request |
| Individual rights | Access and correction | Adds disposal (deletion), data mobility, and an explanation of automated decisions with a legal or similarly significant effect, with a route to human review |
| Children | No specific provisions | A child (under 18) is defined; children's personal information is treated as sensitive |
| De-identification | Limited guidance | De-identified and anonymized information are defined; re-identification is prohibited and carries the highest offence penalties |
| Transfers outside Canada | Accountability through contracts with service providers | A privacy impact assessment and risk-mitigation measures are required before personal information is disclosed or transferred outside Canada; service providers must give equivalent protection |
| Private right of action | None | Individuals may sue for damages where a contravention has been established, within two years |
| Breach reporting | Report breaches posing a real risk of significant harm, notify affected individuals, keep records of all breaches | Breach reporting continues, with form and content to be set by regulation |
If you prepared for the CPPA
Most of that work still counts. Much of C-27's substance carries forward, and the consent rules are largely aligned. The differences that matter most:
- Enforcement is consolidated. C-27 split enforcement between the Privacy Commissioner and a new tribunal. C-36 places it within a single Commission, with appeals to the Federal Court.
- Legitimate interest goes further. The exception now extends to disclosure, not just collection and use.
- The automated-decision test has changed. Explanation duties apply to decisions with a "legal or similarly significant effect".
- No AI law attached. C-27 bundled the proposed Artificial Intelligence and Data Act; C-36 is a privacy and consumer data bill only.
What stays the same
PIPEDA's foundations, including accountability, limiting collection, use and disclosure, safeguards, openness and individual access, remain at the core of the proposed law. Mandatory breach reporting, in place since 2018, continues.
That means a mature PIPEDA program is a real head start. The work done on governance, data inventories, consent and access requests carries over. The gap is in the new and strengthened obligations, and it is the size of the penalties that makes that gap matter.
What to do now
None of these steps depend on the final wording of the bill. Each one reduces risk under PIPEDA and Law 25 today and shortens the path to whatever passes.
Map your personal information
Know what you collect, where it lives, how it flows and who can access it, including sensitive information and any children's data. Consent, deletion, mobility and cross-border assessments all depend on this.
Review consent
Check that consent language is plain, specific and unbundled. Identify where you rely on implied consent, and whether that reliance would still hold under an express-by-default rule.
Document your privacy management program
Write down the policies, procedures, training and roles you already have, close the obvious gaps, and confirm who is accountable. Under C-36 you would need to produce it on request.
Prepare for new rights requests
Build processes for deletion and data mobility alongside access and correction. Deletion in particular is hard to do reliably without a data map and clear retention rules.
Inventory automated decision-making
List the systems that make or support decisions about individuals, such as credit, pricing, fraud detection or hiring, and confirm you could explain the information and principal factors behind a decision.
Assess transfers outside Canada
Identify where personal information leaves Canada, including through cloud and SaaS providers, and set up a repeatable privacy impact assessment method you can apply before new transfers.
Strengthen supplier contracts
Make sure service providers are bound to an equivalent level of protection, with breach notification and audit rights. Fold this into your existing third-party risk program rather than running it separately.
Test your breach response
Exercise the plan and confirm your breach records are complete. This is already required under PIPEDA, and a breach is the most likely way a program comes under a regulator's scrutiny.
Sector considerations
Financial services. Organizations overseen by FSRA or OSFI already manage privacy within broader cybersecurity, third-party risk and data governance expectations. Treat C-36 preparation as part of those programs, not a separate initiative. Privacy and security share data flows, controls and governance, and running them apart creates gaps and duplicated effort.
Insurance. Insurers hold some of the most sensitive information there is: health, financial and claims history. Stricter consent rules and a private right of action raise the stakes for programs that have not kept pace with data practices.
Public sector and its suppliers. Public institutions remain under public-sector privacy law. The technology and service providers handling their data are private-sector organizations, though, and procurement and contracts can be expected to reflect the new federal expectations.
Why privacy by design pays off
Several of C-36's requirements are assessments: a documented assessment to rely on legitimate interest, and a privacy impact assessment before sending personal information outside Canada. Organizations that already run privacy impact assessments when systems are designed, rather than after they are built, will find these duties far easier to meet.
What designing privacy in looks like
- Consent captured and recorded by the system, so it can be demonstrated rather than reconstructed
- Data minimization in the data model, which shrinks the scope of consent, deletion and mobility obligations
- Privacy impact assessments at design time, reused when transfers or new purposes arise
- Retention and deletion built in, so a deletion request is a routine operation rather than a project
- Privacy requirements written into procurement, so supplier protections don't depend on ad-hoc legal review
The bottom line
Bill C-36 confirms the direction the CPPA set: binding enforcement, penalties of up to 3% and 5% of global revenue, new individual rights and a private right of action. The timeline is still uncertain. The preparation is not.
Treat the strictest regime you are already subject to, whether Law 25 or GDPR, as your baseline. Build on the PIPEDA program you have. Prepare as an ongoing program rather than a project tied to a legislative date. Organizations that do this will be ready whenever C-36, or whatever replaces it, comes into force.
Download the practitioner guide
This article reflects Sarakinov Consulting's advisory perspective on Canadian privacy reform. It is not legal advice. It reflects Bill C-36 as tabled on June 15, 2026 and its status as of October 2026. Organizations should obtain qualified legal counsel on their specific obligations. Goni Sarakinov holds CIPM and CIPT certifications from the International Association of Privacy Professionals.
Sources: Parliament of Canada, LEGISinfo: Bill C-36 (45-1) · Gowling WLG, Understanding Bill C-36 · McCarthy Tétrault, Bill C-36: What Organizations Need to Know · MLT Aikins, Implications of Bill C-36 · Bennett Jones, Bill C-36 and Canadian Privacy Reform
Continue reading