The status, in one box
This page is the full explanation of the status box that appears on /laws, /federal and /issues/data-breaches. All four read from the same record, so a stage change updates every one of them at once.
What PIPEDA gives you today
The Personal Information Protection and Electronic Documents Act is the federal private-sector privacy law and has been since 2000. It applies to organizations that collect, use or disclose personal information in the course of commercial activity, and it applies across the country except in the provinces whose own private-sector laws have been declared substantially similar, which are Quebec, British Columbia and Alberta.
PIPEDA works through ten fair information principles in Schedule 1: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. A person can ask an organization what it holds about them, ask for a correction, and complain to the Office of the Privacy Commissioner of Canada if the organization does not answer properly.
Two things about PIPEDA are what the bill is aimed at. First, the Privacy Commissioner cannot impose a fine. The Commissioner investigates, issues findings and recommendations, and can take a matter to the Federal Court, but the office has no power to order a penalty on its own. Second, an individual's route to money runs through a Federal Court application under section 14 after the Commissioner reports, rather than through a direct claim against the organization.
What the bill proposes to change
Bill C-36 would repeal Part 1 of PIPEDA and put the Protecting Privacy and Consumer Data Act in its place. Schedule 1 and the fair information principles would go, replaced by obligations written directly into the statute. The consent architecture, the breach duties and the access and correction rights carry forward in substance, but the enforcement machinery around them is rebuilt.
The clearest structural change is the oversight body. The bill establishes a Digital Safety and Data Protection Commission of Canada, and within it designates a Privacy and Consumer Data Commissioner (clause 85(1)) heading a Privacy and Consumer Data Division (clause 89). That is a different design from the previous Parliament's Bill C-27, which would have kept the Privacy Commissioner and added a separate Personal Information and Data Protection Tribunal to impose penalties. Under C-36 the enforcement function sits inside the commission rather than in a stand-alone tribunal.
The bill also carries an administrative monetary penalty scheme (clauses 113 to 117, with clause 114 setting the maximum) and a set of offences with punishment provisions (clause 145). The specific dollar and percentage-of-revenue figures are set in those clauses; they could not be read reliably from an automated fetch of the first-reading text and are therefore not quoted here.
A private right of action
Clause 132 of the bill as introduced is the change most likely to matter to an individual. It would allow a person to claim damages from an organization for a contravention of the Act. That is a direct route to court against the organization, rather than the current sequence of complaining to the Commissioner, waiting for a report, and then applying to the Federal Court under PIPEDA section 14.
A private right of action also changes what a data breach means commercially. Under PIPEDA a breach triggers a report to the Commissioner and notification to affected individuals, but the financial consequence for the organization is indirect. A statutory damages claim available to every affected person is a different order of exposure, which is why this clause draws most of the commentary on the bill.
None of this is available today. The clause takes effect only if the bill is passed in a form that retains it and is brought into force.
Children's data
The bill treats information about children as a distinct category rather than leaving it to general consent rules. Clause 2 defines a child as an individual under 18 years of age. Clause 4 allows a parent, guardian or tutor to exercise a child's rights under the Act on their behalf.
Beyond those mechanics, the best interests of children is written into the mandate of the institutions themselves: clause 77(d) requires the Commission to consider the best interests of children, and clause 86(d) imposes the same requirement on the Commissioner. That places the standard in every exercise of discretion those bodies make, not only in provisions that name minors.
Quebec already goes further than current federal law here. Under Law 25, consent to the collection of personal information about a minor under 14 must be given by the person having parental authority, unless the collection is clearly for the minor's benefit.
Where the bill sits now, and what still has to happen
A federal bill becomes law only after it clears every stage in both chambers, receives royal assent, and is brought into force. The table records where C-36 stands as of September 5, 2026 according to LEGISinfo.
| Stage | Status | Date |
|---|---|---|
| First reading, House of Commons | Completed | June 15, 2026 |
| Second reading, House of Commons | No activity recorded | — |
| Committee consideration, House of Commons | Not reached | — |
| Report stage | Not reached | — |
| Third reading, House of Commons | Not reached | — |
| First reading, Senate | Not reached | — |
| Royal assent | Not reached | — |
| Coming into force | Not reached | — |
What does not change until royal assent and proclamation
Everything. A bill at second reading creates no obligation and no right. Until C-36 is passed and brought into force, PIPEDA remains the federal private-sector privacy law in full, with its consent rules, its access and correction rights, its breach reporting duty where a breach creates a real risk of significant harm, and its complaint route to the Office of the Privacy Commissioner.
The Commissioner's powers are unchanged as well. The office can investigate, make findings and recommendations, enter compliance agreements and go to the Federal Court, and it still cannot impose a monetary penalty. Nothing in the bill accelerates that.
Royal assent is also not the finish line. Federal statutes commonly come into force on a day fixed by order of the Governor in Council, and provisions can be proclaimed at different times. A dated statement that the new Act applies from a particular day is only reliable once the coming-into-force order is made.
Frequently asked questions
- Is Bill C-36 the law in Canada?
- No. It is a government bill before the House of Commons. It received first reading on June 15, 2026 and is at second reading, house of commons as of September 5, 2026. Bills can be amended in committee, can die on prorogation or dissolution, and create no obligations until they are passed, receive royal assent and are brought into force. PIPEDA is the federal private-sector privacy law today.
- What is the PPCDA?
- PPCDA is the Protecting Privacy and Consumer Data Act, the Act that Bill C-36 would enact. The bill's full title is "An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts". If passed, the PPCDA would repeal Part 1 of PIPEDA and govern personal information collected, used or disclosed in the course of commercial activity.
- Would Bill C-36 let someone sue a company over a privacy breach?
- That is what clause 132 of the bill as introduced proposes: a right to claim damages from an organization for a contravention of the Act. It would be a direct claim against the organization, rather than the present sequence of complaining to the Privacy Commissioner, waiting for a report, and then applying to the Federal Court under PIPEDA section 14. The clause has no effect unless the bill is passed with it intact and brought into force.
- How is Bill C-36 different from Bill C-27?
- Bill C-27 was the previous Parliament's privacy reform and it died on dissolution in 2025. It would have kept the Privacy Commissioner and created a separate Personal Information and Data Protection Tribunal to impose penalties, and it carried the Artificial Intelligence and Data Act as a third part. Bill C-36 takes a different shape: it establishes a Digital Safety and Data Protection Commission of Canada, designates a Privacy and Consumer Data Commissioner within it (clause 85(1)) and a Privacy and Consumer Data Division (clause 89), and places enforcement inside that commission rather than in a stand-alone tribunal.
- What would change for children's personal information?
- The bill defines a child as an individual under 18 (clause 2) and allows a parent, guardian or tutor to exercise a child's rights under the Act (clause 4). It also writes the best interests of children into institutional mandates: clause 77(d) for the Commission and clause 86(d) for the Commissioner. Under current federal law there is no equivalent statutory age definition; the Office of the Privacy Commissioner addresses children through its meaningful consent guidance. Quebec's Law 25 already requires parental consent for collecting personal information about a minor under 14 unless the collection is clearly for the minor's benefit.