Bill C-27 Digital Charter: What Canadian Businesses Need to Know

Canada's privacy landscape is on the verge of its most significant transformation in over two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, represents the federal government's ambitious attempt to modernise how personal data and artificial intelligence are governed across the country. If enacted, it will replace parts of the aging Personal Information Protection and Electronic Documents Act (PIPEDA) and introduce Canada's first federal framework for AI regulation.

Whether you run a small e-commerce shop in Vancouver, operate a fintech startup in Toronto, or simply want to understand your rights as a Canadian consumer, Bill C-27 will almost certainly affect you. This guide breaks down what the bill contains, why it matters, and how to prepare.

What Is Bill C-27?

Bill C-27 is a federal Canadian legislative package introduced in June 2022 by the Minister of Innovation, Science and Industry. It bundles three distinct but interconnected acts into a single piece of legislation: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (DPTA), and the Artificial Intelligence and Data Act (AIDA).

Together, these three acts aim to modernise Canada's privacy regime, create a specialised tribunal for enforcement, and establish the country's first comprehensive AI governance framework. The bill is the successor to Bill C-11, which died on the order paper in 2021, and reflects years of consultation with industry, privacy advocates, and provincial regulators.

The Three Pillars of Bill C-27

1. Consumer Privacy Protection Act (CPPA) — Replaces Part 1 of PIPEDA and introduces stronger consumer rights, higher penalties, and clearer consent requirements.
2. Personal Information and Data Protection Tribunal Act (DPTA) — Creates a new administrative tribunal to hear appeals and impose penalties for CPPA violations.
3. Artificial Intelligence and Data Act (AIDA) — Establishes Canada's first federal law governing "high-impact" AI systems.

Why Bill C-27 Matters Right Now

PIPEDA was enacted in 2000, long before smartphones, social media, cloud computing, or generative AI existed in their current forms. The gaps have become increasingly obvious: maximum fines under PIPEDA are capped at $100,000 per violation, which barely registers for multinational tech companies. Meanwhile, the European Union's GDPR allows fines of up to 4% of global annual revenue, and Quebec's Law 25 already imposes penalties up to $25 million or 4% of worldwide turnover.

Without modernisation, Canada risks losing its "adequacy" status with the EU, which permits free data flows between jurisdictions. Losing adequacy would create significant friction for any Canadian business handling European customer data. Bill C-27 is largely designed to close that gap and bring federal law closer to international standards.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the centrepiece of Bill C-27 and will fundamentally reshape how organisations collect, use, and disclose personal information in Canada. It retains PIPEDA's principles-based foundation while adding sharper teeth and clearer consumer rights.

Key Consumer Rights Under the CPPA

• Right to data portability — Individuals can request that their personal information be transferred from one organisation to another in a usable format.
• Right to deletion (disposal) — Consumers can ask organisations to delete their personal information, subject to legal and contractual obligations.
• Right to algorithmic transparency — When automated decision systems make predictions, recommendations, or decisions that significantly impact an individual, that person can request a plain-language explanation.
• Enhanced consent requirements — Consent must be obtained in plain language, and organisations must clearly explain purposes at or before the time of collection.
• Special protections for minors — Information about children is deemed "sensitive" by default, triggering higher safeguards.

New Obligations for Organisations

Businesses subject to the CPPA will need to implement a formal privacy management programme, maintain records of their data handling activities, and conduct privacy impact assessments for high-risk processing. Service providers (data processors) will have direct statutory obligations for the first time, rather than just contractual ones.

Penalties That Finally Have Bite

This is where Bill C-27 marks the most dramatic departure from PIPEDA. The CPPA introduces a two-tier penalty structure:

Penalty Type	Maximum Amount	Triggering Conduct
Administrative Monetary Penalty	Greater of $10 million or 3% of global revenue	Serious contraventions of the CPPA
Criminal Offence Fine	Greater of $25 million or 5% of global revenue	Most egregious violations (obstruction, re-identification of anonymised data, retaliation against whistleblowers)
PIPEDA (current law)	$100,000 per violation	Breach reporting failures

The Data Protection Tribunal

The DPTA creates a new quasi-judicial body called the Personal Information and Data Protection Tribunal. This six-member tribunal will hear appeals from decisions of the Privacy Commissioner and determine whether to impose administrative monetary penalties.

Critics have questioned whether adding another layer between the Commissioner and enforcement will slow things down or weaken the Commissioner's authority. Supporters argue the tribunal provides due process and specialised expertise for complex privacy disputes. Either way, it represents a significant structural shift from PIPEDA's current enforcement model, where the Commissioner primarily plays an ombudsperson role.

The Artificial Intelligence and Data Act (AIDA)

AIDA is arguably the most controversial — and most consequential — part of Bill C-27. It would be Canada's first federal law specifically governing AI systems, though its scope is narrower than many expected.

What AIDA Regulates

AIDA applies to "high-impact" AI systems, a term left largely undefined in the original bill and intended to be fleshed out through regulations. Proposed amendments suggest high-impact systems will include those used in:

• Employment decisions (hiring, promotion, termination)
• Provision of essential services
• Biometric identification and inference
• Content moderation at scale
• Healthcare and medical devices
• Law enforcement and immigration

Core AIDA Obligations

1. Risk assessment — Organisations must assess whether their AI system qualifies as high-impact.
2. Mitigation measures — If high-impact, they must establish measures to identify, assess, and mitigate risks of harm or biased output.
3. Monitoring — Ongoing monitoring of compliance with those measures is required.
4. Transparency — Public-facing descriptions of the system's capabilities, limitations, and intended uses.
5. Record-keeping — Detailed documentation that can be produced upon regulatory request.

AIDA also creates new criminal offences for making an AI system available knowing it is likely to cause serious physical or psychological harm, or for using personal information obtained unlawfully to design, develop, or use an AI system.

How Bill C-27 Compares to Other Privacy Laws

Feature	Bill C-27 (CPPA)	EU GDPR	Quebec Law 25	PIPEDA (current)
Max fine	5% global revenue	4% global revenue	4% global revenue	$100,000
Right to deletion	Yes	Yes	Yes	Limited
Data portability	Yes	Yes	Yes (2024)	No
Algorithmic transparency	Yes	Yes	Yes	No
Dedicated AI law	Yes (AIDA)	Yes (EU AI Act)	No (covered by Law 25)	No
Private right of action	Yes (limited)	Yes	Yes	No

Who Needs to Comply?

The CPPA applies to every organisation that collects, uses, or discloses personal information in the course of commercial activities — essentially the same scope as PIPEDA. That means federally regulated businesses, interprovincial commerce, and any organisation in provinces without "substantially similar" legislation (currently Quebec, BC, and Alberta have their own private-sector privacy laws).

AIDA has a different and narrower scope: it applies to AI systems used in international or interprovincial trade and commerce. This leaves significant room for provincial AI laws to emerge alongside it.

Practical Steps for Businesses to Prepare

Even though Bill C-27 is still working its way through Parliament and faces an uncertain timeline, forward-looking organisations are already preparing. Here is a practical roadmap:

1. Inventory your data. Map what personal information you collect, where it is stored, who has access, and how long you keep it.
2. Review consent flows. Audit every form, cookie banner, and signup process for plain-language clarity.
3. Draft or update your privacy management programme. This will be a formal CPPA requirement.
4. Catalogue AI and automated decision systems. Identify which could qualify as "high-impact" under AIDA.
5. Strengthen vendor contracts. Service providers will have direct statutory obligations, but prime contractors should still allocate responsibility contractually.
6. Consider privacy-first tooling. Choose services that minimise data collection by design. For example, when sharing links in marketing campaigns, a privacy-conscious shortener like Lunyb helps avoid the invasive tracking common to many link platforms. You can read more in our honest review of Lunyb.
7. Train your team. New rights like deletion and portability require front-line staff who know how to handle requests within statutory timelines.

Criticism and Controversy

Bill C-27 has not had a smooth journey. Privacy advocates have argued the CPPA is weaker than Quebec's Law 25 in several areas, including the definition of consent and the independence of the Privacy Commissioner. The business community, on the other hand, has pushed back against compliance costs, particularly for small and medium enterprises.

AIDA has drawn the sharpest criticism. Opponents argue it was developed without sufficient public consultation, delegates too much substance to future regulations, and places Canada's AI rules in the hands of the Minister of Innovation rather than an independent regulator. Several amendments have been proposed to address these concerns, including carve-outs for open-source AI developers and clearer definitions of "high-impact."

Timeline and Current Status

As of 2024, Bill C-27 was working through committee stage in the House of Commons, where it faced extensive clause-by-clause review and numerous proposed amendments. The bill's ultimate passage depends on the political calendar — a federal election could reset the process entirely, as happened with its predecessor Bill C-11.

Even if passed, the CPPA would likely have a transition period (previously proposed at one to two years), while AIDA's substantive obligations have been signalled not to take effect until 2025 at the earliest, with full enforcement potentially delayed further. Businesses should treat the compliance roadmap as a multi-year programme, not a fire drill.

What Canadian Consumers Should Know

If you are a Canadian consumer, Bill C-27 is designed to give you more meaningful control over your personal information. You will have clearer rights to see what companies know about you, correct or delete that data, and understand when algorithms are making consequential decisions about your life. The ability to actually enforce those rights — through the Commissioner, the Tribunal, and a limited private right of action — is the most significant upgrade.

In the meantime, you can take practical steps today: review the privacy settings on services you use, prefer tools that minimise data collection (encrypted DNS resolvers, private browsers, and privacy-focused analytics alternatives are all worth exploring), and exercise the rights you already have under PIPEDA or your provincial law.

Frequently Asked Questions

When will Bill C-27 become law?

There is no confirmed date. The bill has been in parliamentary committee review and faces an uncertain timeline, especially with the possibility of a federal election. Even once passed, expect a transition period of one to two years before the CPPA takes full effect, with AIDA phased in separately.

Does Bill C-27 replace PIPEDA entirely?

No. It replaces Part 1 of PIPEDA, which governs private-sector collection, use, and disclosure of personal information. The electronic documents provisions in Part 2 of PIPEDA remain. Provincial privacy laws in Quebec, BC, and Alberta that are deemed "substantially similar" continue to apply within those jurisdictions.

How is Bill C-27 different from Quebec's Law 25?

Quebec's Law 25 is already in force and in some ways stricter — it requires designating a privacy officer by name, imposes specific requirements for cross-border data transfers, and has more prescriptive consent rules. Bill C-27 is broader in scope (covering AI through AIDA) but slightly more flexible in several CPPA provisions. Organisations operating nationally will need to comply with both.

Will small businesses be exempt from Bill C-27?

No general small-business exemption exists in the current draft, though the Privacy Commissioner is expected to issue guidance that scales expectations to organisational size and risk. AIDA's focus on "high-impact" AI systems means many small businesses will fall outside its substantive obligations.

How does AIDA compare to the EU AI Act?

The EU AI Act is more comprehensive, with a detailed four-tier risk classification (unacceptable, high, limited, minimal) and prohibitions on specific practices like social scoring. AIDA focuses on a single "high-impact" category and leaves much to future regulation. Both laws share the goal of risk-based governance, but the EU approach is significantly more prescriptive.