Understanding Bill C-36: What organizations need to know about Canada’s proposed privacy reform bill

Key takeaways

• Bill C-36 would enact the Protecting Privacy and Consumer Data Act (PPCDA) as a standalone statute, replacing Part 1 of PIPEDA.
• It would create the Digital Safety and Data Protection Commission of Canada as the new federal private sector privacy regulator, replacing the Office of the Privacy Commissioner of Canada (OPC).
• The bill expressly recognizes privacy as a fundamental right.
• It proposes significant administrative monetary penalties: up to the greater of $10 million or 3% of gross global revenue, and up to the greater of $25 million or 5% of gross global revenue for certain offences.
• Although Bill C-36 does not include a standalone AI statute, the PPCDA would introduce provisions addressing automated decision-making.
• Organizations should begin assessing the potential implications of Bill C-36 early, including its impact on privacy governance, compliance programs and data-driven business practices.

---

 
On June 15, 2026, the Honourable Evan Solomon, Minister of Artificial Intelligence and Digital Innovation, introduced Bill C-36 in the House of Commons.

Formally titled An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, Bill C-36 represents the government’s third attempt to overhaul the federal private sector privacy framework since 2020.

Minister Solomon framed the bill as a watershed moment: "the moment is here," positioning privacy protection as foundational to responsible AI innovation and public trust—a core personal pillar of the government's "AI for All" strategy.

Legislative timeline: The road to Bill C-36

Three attempts over six years to repeal and replace Part 1 of PIPEDA:

For an up-to-date timeline of Bill C-36’s progress through Parliament, see our Bill C-36 Timeline of Developments.

What is the regulatory oversight framework proposed under Bill C-36?

Digital Safety and Data Protection Commission of Canada

The Commission is the overarching independent federal regulator established by section 4 of the Digital Safety and Data Protection Commission of Canada Act, a part of separate Bill C-34 (see our detailed bulletin on C-34 here). It is composed of five full-time members appointed by the Governor in Council. Key functions include:

• Develops guidance materials, standards, and tools for compliance (s. 76(c))
• Coordinates with other federal regulators (CRTC, Competition Bureau) and provincial authorities (ss. 78-82)
• Reviews decisions of the Commissioner on application by an organization or complainant (s. 109)
• Makes binding compliance orders and imposes administrative monetary penalties (ss. 110, 113-114)
• Issues annual reports on the application of the Act (s. 83)

Privacy and Consumer Data Commissioner

The Privacy and Consumer Data Commissioner is a designated member of the Commission, appointed by the Governor in Council under s. 85(1). Key functions include:

• Investigates complaints filed by individuals or initiated by the Commissioner (ss. 97-98)
• Issues notices of contravention (including proposed penalties and orders) (ss. 105-108)
• Enters into compliance agreements with organizations (s. 102)
• Conducts audits to ensure compliance (s. 118)
• Issues interim orders in exigent circumstances (s. 122(1)(d))
• Possesses broad investigative powers including summons, oaths, evidence collection, and premises entry (s. 122)

Privacy and Consumer Data Division

The Privacy and Consumer Data Division is established under s. 89 and is composed of the Commissioner plus at least one other member of the Commission assigned by the Commission. The Division serves a specialized adjudicative and approval function. Key functions include:

• Attempts to resolve complaints through dispute resolution mechanisms such as mediation and conciliation (s. 101)
• Approves codes of practice that provide substantially equivalent protection to the Act (ss. 92-95)
• Approves certification programs for organizations (ss. 93-95)
• May have powers delegated to it by the Commissioner with the consent of the Chairperson (s. 88(1)(b))

What are the key changes proposed under Bill C-36?

Bill C-36 proposes many significant changes to the federal private sector privacy regime. Here are the key concepts so far:

A two-tier penalty regime, plus private right of action

Administrative monetary penalties are capped at the greater of $10 million and 3% of an organization’s gross global revenue (s. 114).

The most serious offences, such as knowingly contravening the breach-reporting duties, the re-identification prohibition, or a Commission order, carry fines up to the greater of $25 million and 5% of gross global revenue on indictment (s. 145).

Enforcement begins with a Commissioner-issued notice of contravention (including any proposed penalty and order), subject to review by the Commission, with appeals to the Federal Court (ss. 107, 126).

A private right of action (s. 132) allows affected individuals to sue for damages once a contravention is established, subject to a two-year limitation period.

The regulator’s mandatory balancing factors (s. 86)

In exercising their powers, the Commission, Commissioner, and Division must weigh enumerated factors: the purpose of the Act; the size and revenue of organizations; the volume and sensitivity of the information; the best interests of children; Canada’s international trade obligations; the importance of supporting economic growth, competition, and innovation; and any other matter of general public interest.

These factors signal a proportionate, context-sensitive approach to enforcement that expressly accounts for innovation and the circumstances of the organization.

Privacy management programs & accountability (ss. 8-9)

Every organization must implement and maintain a documented privacy management program covering the protection of personal information, complaint and request handling, staff training, and explanatory materials, scaled to the volume and sensitivity of the information it holds (s. 9).

Organizations must also designate one or more individuals responsible for compliance and provide their contact information on request (s. 8), and the program must be producible to the Commission on request.

Automated decision-making: Explanation & human review (s. 63)

An “automated decision system” is defined broadly to include rules-based systems, regression analysis, predictive analytics, machine learning, deep learning, and neural networks.

Where such a system makes a prediction, recommendation, or decision about an individual that could have a legal or similarly significant effect, the organization must, on request, provide an explanation, including the type of personal information used, its source, and the principal factors involved (s. 63(4)-(5)).

The threshold is raised from the former “significant impact” standard under earlier reform legislation to a “legal or similarly significant effect,” and individuals have the right to make written representations to a human employee able to review the decision (s. 63(6)).

"De-identified" vs. "anonymized" information

Bill C-36 draws a clear and consequential distinction between these two concepts:

• De-identify: To modify personal information so that an individual cannot be directly identified from it, without necessarily eliminating the risk that the individual could be identified.
• Anonymize: To irreversibly and permanently modify personal information to ensure that there is no reasonably foreseeable risk in the circumstances that an individual can be identified, directly or indirectly, by any means.

A legislatively enshrined definition of "sensitive information"

For the first time, the federal statute provides a statutory definition of "sensitive" personal information:

"Sensitive" describes personal information in respect of which, taking into account the circumstances, an individual has a heightened expectation of privacy, including:

• A child's personal information
• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic information
• Health information
• Biometric information capable of uniquely identifying the individual
• Information concerning sexual orientation

"Child" is defined as an individual under 18 years of age. The Commission must consider "best interests of children" when exercising its powers and duties.

Sensitivity drives obligations throughout the Act: security safeguards (s. 56), retention periods (s. 52), and calibration of express vs. implied consent (s. 15).

Mandatory privacy impact assessments for cross-border transfers (s. 57)

Before disclosing or transferring personal information outside Canada, an organization must:

1. Carry out a privacy impact assessment in accordance with prescribed requirements; and
2. Implement measures to mitigate the risks identified, such as:
   • Contractual privacy protection measures
   • Adherence to a code of practice or certification process approved by the Division
   • Other prescribed measures

Accountability: The organization must, on request, provide the Commission with access to or a copy of the privacy impact assessment (s. 57(2)).

New consent exceptions: "Business activities" & "legitimate interest"

Bill C-36 carries forward and broadens the consent exceptions first seen in Bill C-27's CPPA:

Business Activities (s. 18(2)): Consent not required for collection/use where the activity is:

1. Necessary to provide a product or service the individual requested;
2. Necessary for information, system, or network security;
3. Necessary for the safety of a product or service; or
4. Any other prescribed activity.

Note: The business activities exception is limited to collection and use and does NOT extend to disclosure.

Legitimate interest (s. 18(3)): An organization may collect, use, or disclose personal information without consent for an activity in which the organization has a legitimate interest that outweighs any reasonably foreseeable adverse effect on the individual, IF:

1. A reasonable person would expect the collection, use, or disclosure; and
2. The personal information is not collected, used, or disclosed for the purpose of influencing the individual's behaviour or decisions.

Change from C-27: Legitimate interest now extends to disclosure (C-27 limited it to collection and use only). A documented privacy impact assessment is required as a precondition (s. 18(4)), and the record must be provided to the Commission on request (s. 18(5)).

---

---

A more restrictive business transactions exception (s. 22)

Bill C-36 overhauls the business transactions exception proposed under Bill C-27, adding a general requirement to de-identify personal information before transfer unless certain conditions are met.

The general rule (s. 22(1))

Parties to a prospective business transaction may use and disclose personal information without consent if:

1. The information is de-identified before use/disclosure and remains so until the transaction completes;
2. The parties have an agreement requiring the recipient to use/disclose solely for transaction purposes, protect with proportionate safeguards, and return/dispose if the transaction does not proceed;
3. The parties comply with the agreement; and
4. The information is necessary to determine whether to proceed with—and if proceeding, to complete—the transaction.

---

---

How should organizations prepare for Bill C-36?

While Bill C-36 has a long road ahead, organizations may wish to begin considering its potential implications:

1. Review anonymization and de-identification practices in light of the proposed new standard.
2. Consider cross-border data transfer practices and associated risk assessment procedures.
3. Evaluate data handling practices involving minors and sensitive personal information.
4. Consider the use of automated decision-making systems and related transparency obligations.
5. Review existing privacy management programs and governance structures.
6. Consider consent practices, particularly for activities involving behavioural or decision-related purposes.

What happens next?

Bill C-36 must still pass through the legislative process before becoming law, including Second Reading, committee study, third reading, and reporting stage, and full consideration in the Senate, including debate and committee consideration.

We are closely monitoring Bill C-36. For more information, contact a member of our Cyber Security and Data Protection Group

Parliamentary timing

• Parliament rose for the summer on June 18, 2026.
• Regular sittings scheduled to resume September 21, 2026, with Bill C-36 poised to begin Second Reading in the fall.
• The summer recess is a key window for stakeholder consultation.