The roles of commissioners, courts, tribunals, and individuals in Canadian privacy enforcement.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Canadian privacy enforcement combines commissioner investigations, court applications, civil torts, and criminal prosecution. Enforcement has historically been weak compared to jurisdictions like the EU, but Quebec's Law 25, new provincial reforms, and the federal Bill C-36 (introduced June 2026) are adding order-making powers and significant penalties.
Commissioner investigations
The OPC and provincial commissioners investigate complaints and issue reports. Some commissioners have order-making power; others can only make recommendations.
Commissioners also audit organizations proactively and issue public guidance.
Courts and tribunals
PIPEDA complainants can apply to the Federal Court for orders, including damages.
Bill C-36, the Protecting Privacy and Consumer Data Act (at second reading as of September 2026), would create a Digital Safety and Data Protection Commission with power to impose administrative monetary penalties; its predecessor Bill C-27 died in 2025.
Provincial superior courts hear privacy tort claims and class actions.
Criminal prosecution
Criminal Code sections cover voyeurism, non-consensual distribution of intimate images, interception of private communications, and identity theft. Prosecution is typically led by Crown counsel following a police investigation.
Administrative monetary penalties
Quebec's Law 25 allows penalties up to the greater of $10 million or 2% of worldwide turnover. Bill C-36 proposes similar penalties federally. As introduced, the maximum penalty is the greater of $10 million and 3% of the organization's gross global revenue (clause 114). For knowing contraventions of listed provisions and for obstruction, the fine on indictment is up to the greater of $25 million and 5% of gross global revenue, and on summary conviction the greater of $20 million and 4% (clause 145). These figures are from the bill's first-reading text and could change if the bill is amended.