Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is on the verge of its most significant transformation in over two decades. Bill C-27, the Digital Charter Implementation Act, 2022, proposes to overhaul how organizations collect, use, and disclose personal information, while also introducing the country's first dedicated framework for artificial intelligence. Whether you run a small online business, manage a marketing team, or simply care about your digital rights as a Canadian, understanding Bill C-27 is essential.

This guide breaks down what Bill C-27 actually contains, why it matters, who needs to comply, and how to prepare your organization for the changes ahead.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is a Canadian federal bill introduced in June 2022 that bundles three major pieces of legislation into a single package. Its purpose is to modernize Canada's private-sector privacy law, create a new tribunal for enforcement, and establish national rules for high-impact artificial intelligence systems.

The bill replaces the privacy provisions of the long-standing Personal Information Protection and Electronic Documents Act (PIPEDA), which has governed private-sector data handling in Canada since 2000. With digital commerce, AI, and cross-border data flows now central to the Canadian economy, lawmakers have argued that PIPEDA is no longer fit for purpose.

The Three Acts Inside Bill C-27

Consumer Privacy Protection Act (CPPA) — the new core privacy law replacing Part 1 of PIPEDA.
Personal Information and Data Protection Tribunal Act (PIDPTA) — creates an independent tribunal to review decisions and impose penalties.
Artificial Intelligence and Data Act (AIDA) — Canada's first federal law governing the design, development, and deployment of high-impact AI systems.

Why Bill C-27 Matters

Bill C-27 matters because it shifts Canadian privacy law from a guidance-based, complaint-driven model to a rights-based regime with serious financial consequences. Under PIPEDA, the Privacy Commissioner could investigate and recommend, but could not directly fine organizations. Under the CPPA, administrative monetary penalties could reach up to $10 million or 3% of global revenue, and offences could trigger fines of up to $25 million or 5% of global revenue — among the highest in the world.

For Canadians, the bill introduces stronger consent rules, a right to data mobility, a right to deletion, algorithmic transparency, and special protections for minors. For businesses, it raises the compliance bar significantly — especially for those that use AI, profile users, or operate across borders.

Key Changes Under the Consumer Privacy Protection Act (CPPA)

The CPPA is the heart of Bill C-27. It modernizes consent, expands individual rights, and imposes new accountability obligations on organizations of all sizes.

1. Stronger, Clearer Consent

Organizations must obtain consent in plain language, at or before the time of collection. The plain-language requirement explicitly targets the dense, lawyer-drafted privacy policies most users skip. Consent requests must explain:

The purposes of collection, use, or disclosure
The way information will be collected
Any reasonably foreseeable consequences
The specific types of personal information involved
Names or types of third parties to whom information may be disclosed

2. New Exceptions for "Business Activities" and "Legitimate Interest"

The CPPA introduces a limited exception allowing organizations to collect or use personal information without consent for certain business activities (such as service delivery, security, or product improvement) and for legitimate interests that outweigh potential adverse effects. Both come with documentation and assessment requirements.

3. Right to Deletion (Disposal)

Individuals can request that an organization dispose of their personal information when consent is withdrawn, the information is no longer necessary, or it was collected in violation of the Act. This is similar to the GDPR's "right to be forgotten," with carve-outs for legal obligations and freedom of expression.

4. Data Mobility

The CPPA establishes a framework for individuals to direct the transfer of their personal information from one organization to another, subject to forthcoming sector-specific regulations (banking is expected first).

5. Algorithmic Transparency

When an organization uses an automated decision system to make predictions, recommendations, or decisions that could significantly impact an individual, that person has the right to request an explanation of how the decision was made.

6. Enhanced Protections for Minors

The CPPA explicitly classifies the personal information of minors as sensitive, which raises the bar for consent, retention, and the right to disposal. Parents and guardians gain clearer rights to act on behalf of children.

The Artificial Intelligence and Data Act (AIDA)

AIDA is the most novel and most debated piece of Bill C-27. It would be Canada's first federal AI law, focused on "high-impact" systems.

What AIDA Requires

Organizations that design, develop, or deploy high-impact AI systems would be required to:

Assess whether the system qualifies as high-impact
Identify, assess, and mitigate risks of harm or biased output
Monitor compliance with mitigation measures
Publish a plain-language description of the system
Notify the Minister of material harm
Keep records of how data is anonymized and used

What Counts as "High-Impact"?

The definition will be set out in regulations, but a companion document released by Innovation, Science and Economic Development Canada suggested categories such as employment decisions, access to services, biometric identification, content moderation, and healthcare. Penalties for AIDA violations can reach $25 million or 5% of global revenue, with criminal offences for reckless or fraudulent use.

Bill C-27 vs. PIPEDA vs. GDPR: A Comparison

To understand where Bill C-27 fits internationally, it helps to compare it with the law it replaces and the European standard it partially mirrors.

Feature	PIPEDA (current)	Bill C-27 / CPPA	GDPR (EU)
Maximum fine	None (direct)	5% of global revenue or $25M	4% of global revenue or €20M
Right to deletion	Limited	Yes	Yes
Data portability	No	Yes (sector-based)	Yes
Algorithmic transparency	No	Yes	Yes (Art. 22)
Dedicated AI law	No	Yes (AIDA)	Yes (EU AI Act)
Minors' data as sensitive	No explicit rule	Yes	Special protections
Independent tribunal	No	Yes (PIDPTA)	National DPAs

Who Needs to Comply With Bill C-27?

Bill C-27 applies to every private-sector organization that collects, uses, or discloses personal information in the course of commercial activity in Canada — including foreign organizations whose activities have a real and substantial connection to Canada.

This means the bill reaches:

Canadian small businesses and e-commerce stores
SaaS and mobile app developers serving Canadian users
Marketing agencies handling customer data
AI developers and deployers of high-impact systems
Foreign companies (US, EU, Asia) targeting Canadian consumers

Provinces with "substantially similar" laws — Quebec (Law 25), British Columbia, and Alberta — will continue to apply their provincial regimes for activities within their borders, but federal rules still apply to interprovincial and international flows.

How to Prepare Your Organization

While Bill C-27 is still moving through Parliament, smart organizations are already preparing. Compliance is not something you can build overnight, and many CPPA obligations track closely to Quebec's Law 25 and the GDPR — meaning the groundwork pays off across multiple regimes.

A Practical Compliance Checklist

Map your data. Document what personal information you collect, why, where it's stored, how long you keep it, and who you share it with.
Rewrite your privacy policy in plain language. Test it with non-lawyers. If a 14-year-old can't follow it, it's not plain enough.
Appoint a privacy officer. The CPPA requires every organization to designate one and publish their contact information.
Build a privacy management program. Include policies, training, breach response, vendor management, and complaint handling.
Implement data subject request workflows. Access, correction, disposal, and explanation requests will all need timely responses.
Inventory your AI systems. Identify which ones could qualify as high-impact under AIDA and document risk assessments now.
Review vendor contracts. Ensure processors and third parties offer protections equivalent to your own.
Tighten your security. Encryption in transit and at rest, strict access controls, and logging are baseline expectations.

Bill C-27 and Everyday Online Tools

Compliance isn't only about formal policies — it also extends to the everyday tools your team uses for marketing, analytics, and link sharing. Anything that tracks user behaviour, builds profiles, or shares data with third parties becomes a point of risk under the CPPA.

For example, if you use a link shortener for campaigns, you should choose one that is transparent about what it logs, respects user privacy, and gives you control over analytics. Privacy-respecting tools like Lunyb offer URL shortening without the bloated tracking stacks of legacy providers — a useful trait when you're trying to minimize the personal information your campaigns collect. If you want a deeper look, see our honest review of Lunyb or our broader 2026 buyer's guide to URL shorteners for comparisons with alternatives like the ones discussed in our Rebrandly review.

Enforcement: The New Tribunal and Penalties

Under Bill C-27, the Office of the Privacy Commissioner of Canada (OPC) gains stronger investigative and order-making powers. The new Personal Information and Data Protection Tribunal would review OPC decisions and impose administrative monetary penalties.

The enforcement ladder looks roughly like this:

OPC investigation → findings and compliance orders
Tribunal review → administrative monetary penalties up to 3% of global revenue or $10M
Criminal prosecution for the most serious offences → fines up to 5% of global revenue or $25M

These numbers signal that privacy compliance is no longer a back-office concern — it's a board-level risk.

Current Status and Timeline

Bill C-27 was introduced in June 2022 and has worked its way through committee study with numerous proposed amendments, particularly to AIDA. Industry groups have asked for clearer definitions, while civil society has called for stronger rights and faster enforcement. The bill's passage and coming-into-force date will depend on the parliamentary calendar, but most legal observers expect a transition period of 12 to 24 months after royal assent before full enforcement begins.

Even if the final text changes, the direction is clear: stronger rights, bigger fines, mandatory AI governance, and tighter accountability. Waiting for the law to settle before acting is a risky strategy.

Frequently Asked Questions

Is Bill C-27 already law in Canada?

No. As of early 2026, Bill C-27 has not yet received royal assent. It remains under parliamentary review, with active debate around amendments to the Artificial Intelligence and Data Act. However, organizations should not wait — many obligations mirror Quebec's Law 25, which is already in force.

How is Bill C-27 different from Quebec's Law 25?

Quebec's Law 25 applies only within Quebec and is already fully in effect. Bill C-27 is federal and applies to private-sector commercial activity across Canada and to foreign organizations with a substantial connection to Canada. The two regimes share many concepts (consent, deletion, privacy officers, automated decisions), so compliance work largely overlaps.

Does Bill C-27 apply to small businesses?

Yes. Unlike some jurisdictions, the CPPA does not exempt small businesses based on size. If you collect personal information in the course of commercial activity, you are covered. That said, the law's accountability requirements are proportionate — a sole proprietor's privacy program won't look like a bank's.

What is a "high-impact" AI system under AIDA?

The exact definition will be set in regulations, but the government has signalled that systems used for hiring, credit, biometric identification, content moderation, healthcare decisions, and access to essential services are likely candidates. Organizations should begin classifying their AI portfolio now.

What are the penalties for non-compliance?

Administrative monetary penalties can reach the greater of $10 million or 3% of global revenue. For serious offences prosecuted under the Act, fines climb to the greater of $25 million or 5% of global revenue. AIDA carries similar maximums plus potential criminal liability for reckless or fraudulent use of AI.

Final Thoughts

Bill C-27 represents a generational shift in Canadian privacy and AI regulation. It modernizes consent, gives individuals real rights, creates meaningful enforcement, and finally puts AI governance on a statutory footing. For organizations, the message is unambiguous: privacy is now a strategic, board-level concern with real financial consequences.

The good news is that preparation pays dividends. A clean data map, plain-language policies, an appointed privacy officer, and privacy-respecting tools will not only meet CPPA requirements but also strengthen customer trust — the most underrated competitive advantage in the digital economy.