Status of the bill
Bill C-27 was tabled in June 2022, was studied at committee, and died on the Order Paper when the 44th Parliament ended in 2025. Bill C-36 was introduced on June 15, 2026 by the Minister of Artificial Intelligence and Digital Innovation and is at second reading as of September 2026. Current status is on the Parliament of Canada's LEGISinfo page for Bill C-36.
Even if enacted, the new Act would have a transition period before it takes effect. PIPEDA remains the governing federal private-sector privacy law until then.
What Bill C-36 would change
Compared with PIPEDA, the Protecting Privacy and Consumer Data Act as introduced would:
- Raise administrative monetary penalties to up to 3% of global revenue or $10 million for certain violations; up to 5% or $25 million for more serious offences.
- Strengthen the concept of valid consent and require plain-language explanations.
- Create a specific regime for de-identified information and anonymized information.
- Add a right of data mobility (portability) for personal information between organizations.
- Create a right to deletion ('disposal') at an individual's request, subject to legal and business exceptions.
- Require automated-decision transparency for decisions that could have significant impact on an individual.
- Codify protections for minors' personal information.
- Modernize breach notification and record-keeping requirements.
Who would enforce it
Bill C-36 creates a Digital Safety and Data Protection Commission of Canada, led by a Privacy and Consumer Data Commissioner, to enforce the new Act and impose administrative monetary penalties. This replaces the C-27 design, which paired an expanded Office of the Privacy Commissioner with a separate Personal Information and Data Protection Tribunal.
What happened to AIDA
The Artificial Intelligence and Data Act was Part 3 of Bill C-27 and would have regulated 'high-impact' AI systems through a federal AI and Data Commissioner. It died with C-27 and is not part of Bill C-36.
Bill C-36 addresses AI only through privacy rules, such as transparency about automated decision systems. There is no stand-alone federal AI statute before Parliament as of September 2026.
What it means for Canadians today
Bill C-36 signals the direction of federal privacy reform even before it is enacted. Many organizations are preparing for stricter consent and breach obligations, higher penalties, and new individual rights around automated decisions and data portability.
Whether or not Bill C-36 passes, Quebec residents already have many of these rights under their provincial Act as amended by Law 25, which serves as a preview.