Canada's privacy law after Bill C-11: where things stand in 2026

Canada has tried to replace its federal private-sector privacy law three times since 2020. Two bills died when Parliament ended. The third, Bill C-36, was tabled in June 2026 and has not passed second reading yet. PIPEDA is still the law, and the province you operate in may matter more than Ottawa does.

This is a practitioner's summary of where Canadian privacy law stands in October 2026: what PIPEDA requires today, what Bills C-11 and C-27 proposed and why neither became law, what the new bill would change, and how the Quebec, Alberta and British Columbia laws fit in. The thread running through all of it is cost: what each regime puts on your budget, in fines, engineering work and process. This is not legal advice.

PIPEDA today: the law that keeps surviving

The Personal Information Protection and Electronic Documents Act (PIPEDA) received royal assent in April 2000. It covers private-sector organizations that collect, use or disclose personal information in the course of commercial activity. It also always covers federally regulated businesses (banks, telecoms, airlines and other federal works, undertakings or businesses), including their employee data. The Justice Laws consolidation was current to September 21, 2026 when this was written, and the Act was last amended in March 2025.

The core obligations sit in Schedule 1, which lists ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance. They are principles, not checklists. That has made PIPEDA flexible, and also hard to enforce.

Breach reporting

Since November 1, 2018, PIPEDA has required organizations to report any breach of security safeguards to the Privacy Commissioner when it is reasonable to believe the breach creates a "real risk of significant harm" to an individual (section 10.1). The same test triggers notice to the affected individuals, and you may also have to notify other organizations that can reduce the harm (section 10.2). Every breach, reportable or not, goes into a breach record (section 10.3). The Breach of Security Safeguards Regulations require you to keep each record for 24 months from the day you determine the breach occurred.

In practice, the breach record is where small teams fall down. If your incident tracker can't produce a list of every safeguards breach from the past two years, with a note on why each one was or wasn't reported, you have a gap the Commissioner can ask about.

Enforcement, or the lack of it

The Office of the Privacy Commissioner of Canada (OPC) investigates complaints and publishes findings, but it cannot issue binding orders or administrative fines under PIPEDA. If an organization ignores a finding, the complainant or the Commissioner can apply to the Federal Court, which can order changes and award damages. The OPC can also enter into compliance agreements.

The only fines in the Act are criminal. Under section 28, knowingly failing to report a breach, failing to keep breach records, retaliating against a whistleblower, destroying information someone has requested, or obstructing an investigation is an offence. The maximum is $10,000 on summary conviction and $100,000 on indictment. Those numbers are small next to GDPR or even Quebec, and that gap is what every reform bill since 2020 has tried to close.

Bill C-11 (2020): the first attempt

Bill C-11, the Digital Charter Implementation Act, 2020, was introduced in the House of Commons on November 17, 2020. It would have replaced the privacy part of PIPEDA with a new Consumer Privacy Protection Act (CPPA) and created a Personal Information and Data Protection Tribunal.

The financial teeth were the headline. Under the bill text, the Tribunal could impose administrative penalties on the Commissioner's recommendation of up to the higher of $10 million and 3% of gross global revenue. The most serious offences carried fines of up to the higher of $25 million and 5% of gross global revenue. The bill also added a private right of action, a right to data mobility, explanations of automated decisions, and a requirement for written privacy management programs.

C-11 never got past second reading. Its last activity on LEGISinfo is second reading debate on April 19, 2021. The session ended in August 2021 when Parliament was dissolved for the federal election, and the bill died with it.

Bill C-27 (2022): CPPA plus AI regulation

The government reintroduced the privacy reform as Bill C-27, the Digital Charter Implementation Act, 2022, on June 16, 2022. It had three parts: a revised CPPA, the Personal Information and Data Protection Tribunal Act, and a new Artificial Intelligence and Data Act (AIDA) for "high-impact" AI systems.

The penalty structure in the CPPA was the same as C-11: administrative penalties up to the higher of $10 million and 3% of gross global revenue, and offence fines up to the higher of $25 million and 5%. AIDA had its own offence regime with similar ceilings.

C-27 got further than its predecessor. It passed second reading on April 24, 2023 and went to the Standing Committee on Industry and Technology, which held meetings on it from September 2023 to September 2024. The AI part drew the most criticism and slowed everything down. The committee never finished. The session ended on January 6, 2025, when Parliament was prorogued, and C-27 died on the order paper. A general election followed in April 2025.

Bill C-36 (2026): the Protecting Privacy and Consumer Data Act

On June 15, 2026, the Minister of Artificial Intelligence and Digital Innovation introduced Bill C-36 in the first session of the 45th Parliament. It would enact the Protecting Privacy and Consumer Data Act (PPCDA), repeal Part 1 of PIPEDA and rename what is left the Electronic Documents Act. As of early October 2026, LEGISinfo shows it at second reading in the House of Commons, with only first reading completed.

Based on the first-reading text and the government backgrounder, the main differences from C-27 are:

• No AI act bundled in. The AIDA part is gone. AI shows up through transparency duties for automated decision systems instead.
• A new regulator. The bill creates the Digital Safety and Data Protection Commission of Canada. A Privacy and Consumer Data Commissioner would be designated within it, and a Privacy and Consumer Data Division (the Commissioner plus at least one other Commission member) would handle penalty proceedings. There is no separate tribunal as in C-11 and C-27.
• Penalties. Administrative penalties are capped at the greater of $10 million and 3% of gross global revenue for all contraventions found in one investigation. Indictable offences carry fines up to the greater of $25 million and 5% of gross global revenue. Summary conviction offences go up to the greater of $20 million and 4%.
• Private right of action. Section 132 gives individuals a cause of action for damages once a contravention has been found and appeals are exhausted, or after an offence conviction.
• Children. The backgrounder says organizations will be held to a higher standard for children's personal information.
• Deletion, mobility, transfers. Individuals could request disposal of their information in certain circumstances, data mobility would apply where a framework exists, and organizations would have to assess privacy risks before sending personal information outside Canada.

Timing is the open question. The bill comes into force on a date the federal cabinet fixes by order, and not before the Commission is set up. The Commission part is itself tied to another bill, C-34, the Safe Social Media Act. The government has said it will consult on the transition. No date has been announced, and the bill could still change in committee or die if Parliament ends early, as its two predecessors did.

Provincial laws that apply instead of PIPEDA

Three provinces have private-sector privacy laws that the federal government has declared "substantially similar" to PIPEDA. In those provinces, the provincial law generally governs activity inside the province, while PIPEDA still applies to federally regulated businesses and to personal information that crosses provincial or national borders. Many organizations deal with both. The OPC keeps the official list, which also includes health-information laws in Ontario, New Brunswick, Nova Scotia, and Newfoundland and Labrador.

Quebec

Quebec is the strictest regime in Canada and the one most likely to drive your program design. Law 25 (formerly Bill 64) added a mandatory person in charge of personal information, privacy impact assessments, a confidentiality incident register, express consent for sensitive information, privacy-by-default settings, automated-decision notices, portability and de-indexing rights. We cover it in detail in Quebec's Law 25, fully in force.

Alberta

Alberta's PIPA dates from 2004 and was significantly updated in 2010. It already requires breach notification to the Commissioner and affected individuals where there is a real risk of significant harm. In 2025 the province overhauled its public-sector laws: the new Protection of Privacy Act and its regulations came into force on June 11, 2025. That change affects public bodies, not businesses. For the private sector, the government ran a PIPA engagement with an online survey in February 2026, covering harmonization with other laws, individual rights, enforcement, and scope. No amending bill had been introduced when this was written.

British Columbia

BC's PIPA is principles-based and close to Alberta's in structure, with one notable gap. It has no express duty to report breaches. The OIPC BC treats reporting as voluntary, though its guidance says the Act's security requirement may mean you have to tell affected individuals. In a January 2024 statement, the Commissioner said PIPA was nearly alone among North American private-sector laws in lacking mandatory breach notification. If you run a single Canadian incident process, build it to the federal and Alberta standard and apply it in BC too.

What this means for your bottom line

The direct exposure under PIPEDA is still modest: criminal fines capped at $100,000, Federal Court damages awards that have generally been small, and reputational damage from published OPC findings. The real costs come from three other places.

1. Quebec. If you have Quebec customers or employees, Law 25 already exposes you to penalties of up to 2% or 4% of worldwide turnover. That makes Quebec, not Ottawa, the main driver of Canadian privacy spending for most national businesses.
2. Program build-out you'll need anyway. C-11, C-27 and C-36 all require a documented privacy management program, de-identification controls, plain-language consent and automated-decision explanations. Building these once, to the Quebec standard, means the federal law becomes a mapping exercise when it finally passes.
3. Request handling and data mapping. Every version of the federal reform, and Quebec today, adds rights that touch your systems directly: portability in a structured, commonly used format, disposal on request, and explanations of automated decisions. These depend on knowing where personal data lives. See data mapping and discovery and data subject request automation for how teams handle that work.

Budget for a federal penalty regime in the $10 million / 3% range arriving sometime after C-36 passes, plus a transition period the government has not yet defined. Don't budget for a specific date. Two bills have already died on the order paper.

A short compliance plan for Canadian operations

1. Map which law applies to which data: PIPEDA for federally regulated activity and cross-border flows, Quebec, Alberta or BC law for provincial activity, and sector laws for health data.
2. Name a privacy lead and publish their title and contact details. This is mandatory in Quebec and expected everywhere else.
3. Set up one breach process that meets the strictest test you face. Keep a 24-month register covering every incident, and record why each one was or wasn't reported.
4. Run privacy impact assessments on new systems and before sending data outside your province or Canada. Quebec requires both today, and C-36 would add a federal cross-border risk assessment.
5. Inventory automated decisions about individuals and write plain-language explanations of what data each one uses and how it can be reviewed.
6. Watch Bill C-36 on LEGISinfo, and Alberta's PIPA review.

If you operate in more than one country, the privacy regulators directory lists the OPC, the provincial commissioners and their counterparts abroad, and who regulates privacy where explains how these regulators interact. For US comparisons, see our pieces on California's CPRA and the Utah Consumer Privacy Act.

FAQ