Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is undergoing its most significant transformation in over two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, proposes sweeping changes to how organizations collect, use, and disclose personal information — and introduces the country's first dedicated framework for regulating artificial intelligence. If you operate a business in Canada, handle Canadian customer data, or simply care about your digital rights, this legislation will affect you.

In this guide, we break down what Bill C-27 actually does, who it impacts, what penalties it introduces, and how organizations can prepare for compliance.

What Is Bill C-27?

Bill C-27 is a Canadian federal bill that bundles three new pieces of legislation into a single act: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act (PIDPTA), and the Artificial Intelligence and Data Act (AIDA). Together, they would replace the private-sector privacy framework currently set out in Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA).

The bill is the federal government's second attempt at modernizing private-sector privacy law, following the lapse of Bill C-11 when Parliament was dissolved in 2021. It forms the legislative backbone of Canada's Digital Charter, a 10-principle commitment to building Canadians' trust in the digital economy.

The Three Components at a Glance

CPPA – Replaces PIPEDA for private-sector privacy obligations.
PIDPTA – Creates a specialized tribunal to handle privacy appeals and impose penalties.
AIDA – Establishes the first federal rules for the design, development, and deployment of high-impact AI systems.

Why Bill C-27 Matters

PIPEDA was enacted in 2000, before smartphones, social media, generative AI, and the modern data economy existed. It has been criticized as too vague, under-enforced, and incompatible with leading global privacy regimes such as the EU's GDPR. Without modernization, Canada risks losing its EU adequacy status — a designation that allows the free flow of personal data between the EU and Canada.

Bill C-27 aims to:

Strengthen Canadians' control over their personal information.
Bring Canadian privacy law closer to international standards.
Provide the Office of the Privacy Commissioner (OPC) with real enforcement powers.
Set guardrails on AI systems that affect employment, health, financial, or biometric outcomes.

The Consumer Privacy Protection Act (CPPA)

The CPPA is the centrepiece of Bill C-27. It applies to organizations that collect, use, or disclose personal information in the course of commercial activities. Below are the most consequential changes for businesses and individuals.

1. Stronger Consent Requirements

Organizations must obtain valid consent at or before the time personal information is collected. Consent requests must be in plain language and clearly explain:

The purposes for collection, use, or disclosure.
The way the information will be collected.
Any reasonably foreseeable consequences.
The specific type of information involved.
The names of third parties or types of third parties receiving the data.

2. New Individual Rights

The CPPA introduces several new or enhanced rights for Canadians:

Right to disposal (deletion) – Request that organizations dispose of personal information held about you.
Right to data mobility – Move your data between designated organizations (e.g., banks).
Right to algorithmic transparency – Request an explanation when automated decision systems are used to make significant predictions, recommendations, or decisions about you.
Right to withdraw consent – Withdraw consent at any time, subject to legal or contractual restrictions.

3. Enhanced Protections for Minors

Personal information of minors is deemed sensitive by default. This triggers stricter handling, retention, and consent rules, and grants parents or guardians broader powers to access or delete their child's data.

4. De-identified and Anonymized Data

The CPPA draws a clearer line between de-identified data (which still falls under the law) and fully anonymized data (which generally does not). Organizations using de-identification must implement technical and administrative measures proportionate to the risk of re-identification.

5. Privacy Management Programs

Every organization must implement a documented privacy management program covering policies, practices, training, complaint handling, and codes of practice. The OPC can request to review these programs at any time.

Penalties Under the CPPA

One of the most talked-about elements of Bill C-27 is its enforcement teeth. The financial penalties are among the highest in any privacy regime worldwide.

Violation Type	Maximum Administrative Penalty	Maximum Fine (Indictable Offence)
Non-compliance with key CPPA provisions	3% of global gross revenue OR CA$10 million (whichever is higher)	—
Serious offences (e.g., obstructing the Commissioner, breach reporting failures)	—	5% of global gross revenue OR CA$25 million (whichever is higher)
Failure to report a breach of security safeguards	Covered under administrative monetary penalties	Up to CA$25 million on indictment

For comparison, PIPEDA's current maximum fine is CA$100,000 — a sum that many large enterprises consider a rounding error. Bill C-27 fundamentally changes that calculus.

The Personal Information and Data Protection Tribunal

The PIDPTA creates a six-member tribunal that hears appeals of OPC findings and issues administrative monetary penalties. The tribunal is meant to provide a faster, more specialized forum than the Federal Court and ensure due process for organizations facing enforcement action.

How the Process Works

The Privacy Commissioner investigates a complaint or audits an organization.
The Commissioner issues findings and may recommend a penalty.
The organization or complainant can appeal to the tribunal.
The tribunal issues a binding decision, including the amount of any administrative monetary penalty.

The Artificial Intelligence and Data Act (AIDA)

AIDA is Canada's first attempt at federal AI regulation. It focuses specifically on high-impact AI systems — those with the potential to cause significant harm to individuals or groups, including bias and discriminatory outcomes.

Key AIDA Obligations

Risk assessments – Identify and mitigate the risks of harm and biased output.
Transparency – Publish plain-language descriptions of high-impact systems.
Monitoring – Continuously monitor compliance with mitigation measures.
Record-keeping – Document datasets, design decisions, and risk assessment processes.
Incident reporting – Notify the Minister of Innovation if a system causes or is likely to cause material harm.

AIDA Penalties

Violations can lead to administrative penalties and, in cases involving reckless or fraudulent use of personal information to build AI systems, criminal fines of up to CA$25 million or 5% of global gross revenue.

Who Does Bill C-27 Apply To?

The legislation applies broadly to:

Any private-sector organization that collects, uses, or discloses personal information in the course of commercial activities in Canada.
Federally regulated employers handling employee personal information.
Foreign organizations with a real and substantial connection to Canada (e.g., serving Canadian customers).
Designers, developers, and operators of high-impact AI systems used in Canada or affecting Canadians.

Provinces with substantially similar legislation — currently Quebec, Alberta, and British Columbia — may continue to apply their own private-sector privacy laws to intra-provincial activity. Quebec's Law 25, which is already in force, has set a high benchmark that influences how organizations approach C-27 compliance.

How Bill C-27 Compares to PIPEDA and GDPR

Feature	PIPEDA (current)	Bill C-27 (CPPA)	EU GDPR
Maximum fine	CA$100,000	CA$25M or 5% global revenue	€20M or 4% global revenue
Right to deletion	Limited	Yes	Yes
Data portability	No	Yes (designated sectors)	Yes
Algorithmic transparency	No	Yes	Yes (Art. 22)
Dedicated AI law	No	Yes (AIDA)	Yes (EU AI Act)
Breach notification	Mandatory	Mandatory + higher penalties	Mandatory (72 hours)

How Businesses Should Prepare

Even though Bill C-27 is still working its way through Parliament, organizations should not wait for royal assent before acting. Many of the obligations require significant lead time to implement.

1. Conduct a Data Inventory

Map every system, vendor, and process that touches personal information. You cannot protect — or honour requests about — data you do not know you have.

2. Update Consent and Notice Practices

Review privacy policies, cookie banners, and consent flows. Plain-language explanations and granular consent options should replace lengthy legalese.

3. Build an AI Inventory

Catalogue any AI or automated decision systems in use, especially those affecting hiring, lending, insurance, healthcare, or biometric identification. Determine whether any qualify as "high-impact" under AIDA.

4. Strengthen Vendor and Link Hygiene

Third-party tools — including the URL shorteners, tracking pixels, and analytics platforms embedded in your marketing — can quietly collect or share personal data. Choose vendors that minimize data collection, support secure HTTPS redirects, and let you control link-level analytics. A privacy-respecting link platform like Lunyb can help marketing teams shorten and brand URLs without the heavy fingerprinting that some larger services rely on. For deeper comparisons, see our 2026 buyer's guide to URL shorteners and our independent review of Lunyb.

5. Document Everything

Privacy management programs, AI risk assessments, breach response plans, and training records must all be written down. Regulators consistently treat documentation as a strong signal of good faith.

6. Train Your Team

Privacy and AI compliance are not just legal department issues. Marketing, product, engineering, HR, and customer service all need role-specific training.

What Canadians Can Do Right Now

While organizations prepare for compliance, individuals can take practical steps to assert their digital rights today:

Read privacy policies critically — especially the data-sharing sections.
Use encrypted DNS resolvers and privacy-focused browsers to limit passive tracking.
Request access to your data under PIPEDA (and provincial laws) to see what companies hold.
Be cautious with biometric data — once leaked, it cannot be reset like a password.
Verify shortened links before clicking; tools that offer transparency about destination URLs help reduce phishing risk.

Current Status of Bill C-27

Bill C-27 was introduced in June 2022 and has been studied extensively by the House of Commons Standing Committee on Industry and Technology. As of 2026, amendments continue to be debated, particularly around the definition of high-impact AI systems, the structure of the tribunal, and protections for minors. Organizations should monitor the bill's progress and the related regulations, which will fill in many operational details after the bill passes.

Frequently Asked Questions

When will Bill C-27 come into force?

No firm date has been set. Even after royal assent, the CPPA and AIDA include transition periods, and AIDA's substantive obligations are expected to take effect only after supporting regulations are finalized — likely a year or more after enactment.

Does Bill C-27 apply to small businesses?

Yes. The CPPA applies to any organization engaged in commercial activity that handles personal information, regardless of size. However, the law requires compliance measures to be "proportionate" to the volume and sensitivity of the data, giving smaller businesses some flexibility in implementation.

How is Bill C-27 different from Quebec's Law 25?

Quebec's Law 25 is already in force and sets some of the strictest private-sector privacy rules in North America. Bill C-27 aligns federally with many of Law 25's concepts — such as enhanced consent, deletion rights, and algorithmic transparency — but adds a dedicated AI framework (AIDA) that Law 25 does not include.

What counts as a "high-impact" AI system under AIDA?

The bill leaves the precise definition to future regulations, but committee amendments have proposed categories such as employment decisions, essential services (healthcare, finance), biometric identification, content moderation at scale, and law enforcement uses. Organizations using AI in any of these areas should treat themselves as in-scope.

What happens if my business is not compliant?

Non-compliance can trigger investigations by the Privacy Commissioner, orders from the new tribunal, and administrative monetary penalties of up to 3% of global revenue or CA$10 million. Serious offences can escalate to indictable charges with fines up to 5% of global revenue or CA$25 million — plus reputational damage and potential civil litigation under the CPPA's private right of action.

Final Thoughts

Bill C-27 represents a once-in-a-generation modernization of Canadian privacy law and the country's first serious step into AI regulation. Whether you are a startup founder, a marketing manager, an IT leader, or a privacy-conscious Canadian, the legislation will shape how data is handled across the digital economy for decades to come. The organizations that begin building strong privacy and AI governance programs now will be far better positioned — both legally and in terms of customer trust — than those that wait for enforcement to begin.