Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy and AI landscape is undergoing its biggest overhaul in more than two decades. Bill C-27, the Digital Charter Implementation Act, proposes to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modern framework built around three new statutes. If your organization handles personal data, builds AI systems, or markets to Canadians, this legislation will reshape how you operate.

This guide breaks down what Bill C-27 actually contains, who it affects, what penalties it introduces, and the practical steps Canadian businesses should take now to prepare.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is a federal Canadian bill introduced by the Minister of Innovation, Science and Industry. It bundles three separate but related pieces of legislation into a single legislative package designed to modernize how personal data and artificial intelligence are governed in Canada.

The three statutes inside Bill C-27 are:

The Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and becomes Canada's primary private-sector privacy law.
The Personal Information and Data Protection Tribunal Act (PIDPTA) — creates a new tribunal to review decisions made by the Privacy Commissioner and impose administrative monetary penalties.
The Artificial Intelligence and Data Act (AIDA) — introduces Canada's first dedicated federal regulation of "high-impact" AI systems.

Together, these laws form the legislative backbone of Canada's Digital Charter, a 10-principle policy framework first announced in 2019 that promises Canadians stronger control over their personal information, meaningful consent, transparency, and accountability in the digital economy.

Why Bill C-27 Matters Now

PIPEDA was enacted in 2000, long before smartphones, generative AI, large-scale data brokerage, or behavioural advertising became mainstream. Critics — including the Office of the Privacy Commissioner of Canada (OPC) — have argued for years that PIPEDA is outdated, lacks meaningful enforcement, and risks losing Canada's "adequacy" status with the European Union under the GDPR.

Bill C-27 is the government's response. It introduces:

Significantly higher penalties (comparable to GDPR fines).
Stronger consent and transparency rules.
New rights for individuals, including data mobility and the right to deletion.
Specific protections for minors' personal information.
Canada's first horizontal AI regulation.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the centrepiece of Bill C-27. It governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activity. Here's what changes.

1. Meaningful Consent

Organizations must obtain consent in plain language that a reasonable person would understand. Bundled, buried, or overly broad consent clauses — long a staple of Canadian privacy policies — will no longer cut it. Consent requests must clearly identify the purposes, the type of information collected, any third parties involved, and the reasonably foreseeable consequences.

2. New Individual Rights

Right to deletion (disposal): Individuals can request that their personal information be deleted, subject to limited exceptions.
Data mobility: Individuals can request that their data be transferred from one organization to another within a designated framework.
Algorithmic transparency: Individuals have the right to an explanation of automated decisions that could significantly affect them.
Withdrawal of consent: Strengthened and clarified.

3. Special Protections for Minors

The CPPA designates minors' personal information as sensitive by default. This triggers heightened consent requirements, broader deletion rights, and stricter limits on retention and use. Organizations targeting or knowingly collecting data from minors will need to revisit nearly every workflow.

4. Privacy Management Programs

Every organization subject to the CPPA must implement a privacy management program that includes policies, training, complaint-handling procedures, and a designated individual responsible for compliance. The OPC can request a copy of the program at any time.

5. De-identified and Anonymized Data

The CPPA introduces distinct legal definitions for de-identified and anonymized data, with different obligations attached to each. Re-identification of de-identified information is prohibited and carries penalties.

Penalties Under Bill C-27

One of the most significant shifts is the introduction of real financial consequences for privacy violations — something PIPEDA largely lacked.

Type of Penalty	Maximum Fine	Who Decides
Administrative monetary penalties (AMPs)	Up to 3% of global revenue or CAD $10 million (whichever is greater)	Personal Information and Data Protection Tribunal
Serious offences (e.g., knowingly obstructing investigations, re-identification)	Up to 5% of global revenue or CAD $25 million (whichever is greater)	Courts, on indictment
AIDA contraventions (high-impact AI)	Up to 3% of global revenue or CAD $10 million; up to 5% / $25 million for criminal offences	Courts

These figures put Canada roughly in line with the European Union's GDPR, signalling that regulators expect compliance to be treated as a board-level issue rather than a checkbox.

The Artificial Intelligence and Data Act (AIDA)

AIDA is Canada's first attempt at federal AI regulation. It focuses specifically on high-impact AI systems — those whose use could affect health, safety, human rights, or have significant economic consequences.

Core AIDA Obligations

Risk assessment: Organizations must assess whether their AI system qualifies as high-impact.
Mitigation measures: If high-impact, the organization must implement measures to identify, assess, and mitigate risks of harm or biased output.
Monitoring: Ongoing monitoring of the system in production is required.
Transparency: Plain-language descriptions of how the system is used must be published.
Record-keeping: Detailed records of datasets, design choices, and risk measures must be maintained.
Incident reporting: Material harms must be reported to the Minister.

AIDA also creates a new AI and Data Commissioner, housed within Innovation, Science and Economic Development Canada (ISED), to support compliance and enforcement.

Who Does Bill C-27 Apply To?

The CPPA applies to every private-sector organization that collects, uses, or discloses personal information in the course of commercial activities across provincial or national borders. This includes:

Canadian businesses of all sizes, including sole proprietors and startups.
Foreign organizations that process the personal data of Canadians (extraterritorial reach).
Federally regulated employers, with respect to employee data.

AIDA applies to organizations designing, developing, making available, or managing the operation of AI systems in the course of international or interprovincial trade and commerce.

Provinces with "substantially similar" laws (Quebec, British Columbia, and Alberta) may continue to apply their own privacy statutes to intra-provincial activity, but the CPPA will set the federal baseline.

How Bill C-27 Compares to GDPR and Quebec's Law 25

Feature	Bill C-27 (CPPA)	GDPR (EU)	Quebec Law 25
Right to deletion	Yes	Yes	Yes
Data mobility	Yes (framework required)	Yes	Yes
Automated decision transparency	Yes	Yes	Yes
Maximum fine	5% global revenue / $25M CAD	4% global revenue / €20M	4% global revenue / $25M CAD
Dedicated AI law	Yes (AIDA)	Separate (EU AI Act)	No
Minors' data treated as sensitive	Yes	Heightened	Yes

Current Status of Bill C-27

Bill C-27 was tabled in June 2022 and spent extensive time in committee at the House of Commons Standing Committee on Industry and Technology (INDU), where it underwent substantial amendments — particularly to AIDA. Parliamentary delays, prorogation, and political shifts have repeatedly affected its timeline. Businesses should monitor the bill's status on the Parliament of Canada website and treat the law as a near-certainty in some form, even if the final text evolves.

Whether or not C-27 passes in its current shape, the regulatory direction is clear: stronger enforcement, more individual rights, and dedicated AI oversight are coming to Canada.

How Canadian Businesses Should Prepare

Waiting for royal assent is risky. The organizations that fare best under new privacy regimes — as seen with GDPR in 2018 and Quebec's Law 25 — are those that began preparing 12 to 24 months in advance. Here is a practical roadmap.

1. Map Your Data

You cannot protect what you cannot see. Build a comprehensive inventory of every system, vendor, and workflow that touches personal information. Document the legal basis, retention period, and cross-border transfers for each.

2. Rewrite Consent and Privacy Notices

Replace legalese with plain-language summaries. Where possible, layer notices so users see the essentials up front with detailed disclosures one click away. Treat children's data and sensitive categories with explicit, granular consent.

3. Establish a Privacy Management Program

Appoint a privacy officer, document policies, train staff, and set up a documented complaints and breach-response process. Ensure executive leadership reviews the program annually.

4. Audit AI Systems

Inventory every AI/ML system in use. Classify each one against AIDA's likely "high-impact" thresholds, document training data sources, run bias testing, and stand up an incident-response plan specific to model failures.

5. Tighten Vendor and Link Management

Many privacy incidents start with a third-party tool or a leaky tracking link. Review every marketing pixel, analytics script, and short-link provider to ensure they respect consent signals and do not silently aggregate Canadian user data. Platforms like Lunyb offer privacy-respecting URL shortening with click analytics that avoid invasive tracking — a useful option for marketing teams looking to reduce their data-collection footprint while still measuring campaign performance.

6. Prepare for New Individual Rights Requests

Build internal workflows for deletion requests, access requests, automated-decision explanations, and data-mobility transfers. Aim for response times that beat the statutory minimum.

7. Review Cross-Border Data Flows

If you transfer personal information of Canadians outside Canada, document the safeguards, contractual protections, and any jurisdictional risks. Be prepared to disclose these flows transparently.

Common Misconceptions About Bill C-27

"It only applies to big tech." False — the CPPA applies to organizations of all sizes engaged in commercial activity.
"We're already PIPEDA-compliant, so we're fine." Partly true, but the CPPA introduces new rights, higher penalties, and stricter documentation requirements that PIPEDA never demanded.
"AIDA only affects AI companies." False — any business deploying high-impact AI (including off-the-shelf systems) may have obligations.
"Quebec's Law 25 already covers us." Only for intra-provincial activity. Federal requirements still apply elsewhere.

The Bigger Picture: Digital Trust in Canada

Bill C-27 is more than a compliance exercise. It signals Canada's intent to position itself as a jurisdiction where digital trust is enforceable and where AI development can proceed responsibly. For businesses, the upside of strong privacy practice extends far beyond avoiding fines: customer loyalty, brand reputation, and partner due diligence all improve when an organization treats personal data with care.

For practical privacy-forward tooling that supports modern compliance — from secure link sharing to transparent analytics — see our roundup of the best URL shorteners reviewed and compared and our honest review of Lunyb for an in-depth look at one Canadian-friendly option.

Frequently Asked Questions

When will Bill C-27 come into force?

Bill C-27 has not yet received royal assent as of this writing. Even after passing, the CPPA and AIDA include transition periods (AIDA notably has a longer ramp-up). Most observers expect a multi-year implementation timeline, but enforcement of the CPPA's core obligations could begin relatively quickly once the law passes.

Does Bill C-27 replace PIPEDA entirely?

The CPPA replaces Part 1 of PIPEDA — the part dealing with private-sector privacy. The electronic documents provisions of PIPEDA (Part 2) will continue under a renamed statute. So PIPEDA isn't disappearing entirely, but its privacy core is being modernized.

What counts as a "high-impact" AI system under AIDA?

The final definition will be set out in regulations, but the bill and government companion document point toward systems used in employment decisions, access to essential services, biometric identification, content moderation at scale, healthcare, and law enforcement. Organizations should document a reasoned classification for each AI system they deploy.

How do penalties compare to PIPEDA?

PIPEDA had no meaningful administrative penalties — the Privacy Commissioner could only make recommendations and pursue Federal Court orders. Bill C-27 changes that dramatically, introducing fines of up to 5% of global revenue or $25 million CAD, plus a dedicated tribunal to impose them. The shift is comparable to the jump from pre-GDPR European law to GDPR.

What should small businesses do first?

Start with three things: (1) map the personal data you collect and why, (2) rewrite your privacy notice in plain language, and (3) appoint a single person responsible for privacy. These three steps cover the majority of an early CPPA gap and are achievable even without a dedicated legal team.

Will Bill C-27 affect cross-border e-commerce?

Yes. Any foreign business that markets to or processes personal data of Canadians is likely within the CPPA's extraterritorial reach. Cross-border data transfers will require documented safeguards and transparent disclosure to individuals.