Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is on the verge of its most significant transformation in over two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, is a sweeping piece of federal legislation that aims to modernize how organizations collect, use, and disclose personal information — and how artificial intelligence systems are regulated across the country. Whether you run a small online store in Toronto, manage marketing at an enterprise in Calgary, or simply use the internet daily, this bill will affect you.

In this guide, we break down exactly what Bill C-27 contains, who it impacts, how it compares to existing legislation like PIPEDA, and what Canadian businesses should be doing right now to prepare.

What Is Bill C-27?

Bill C-27 is a federal Canadian bill introduced by the Minister of Innovation, Science and Industry that bundles together three major pieces of legislation into a single statutory framework. It is designed to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a stronger, modernized privacy regime and to introduce Canada's first dedicated artificial intelligence law.

The bill is built around three core components:

The Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and sets new rules for handling personal information.
The Personal Information and Data Protection Tribunal Act — creates a new tribunal to review decisions and impose administrative penalties.
The Artificial Intelligence and Data Act (AIDA) — establishes Canada's first federal AI regulation framework.

Together, these three acts represent the operational implementation of the Government of Canada's Digital Charter, a 10-principle framework introduced in 2019 to build trust in the digital economy.

Why Bill C-27 Matters

PIPEDA, Canada's current federal privacy law, was enacted in 2000 — long before smartphones, social media, machine learning, or large-scale data brokerage existed in their current forms. Compared to modern frameworks like the EU's GDPR or Quebec's Law 25, PIPEDA is widely viewed as outdated, lightly enforced, and ill-suited to today's data economy.

Bill C-27 modernizes Canadian privacy law in several critical ways:

Stronger consent standards with plain-language requirements.
New individual rights, including data mobility and disposal (deletion).
Heavy penalties — fines up to 5% of global revenue or $25 million, whichever is greater.
Special protections for minors, treating children's data as inherently sensitive.
Regulation of automated decision-making and high-impact AI systems.

The Three Pillars of Bill C-27

1. The Consumer Privacy Protection Act (CPPA)

The CPPA is the heart of Bill C-27. It governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. Key obligations include:

Meaningful consent: Organizations must obtain consent in clear, understandable language — no more buried legalese.
Right to disposal: Individuals can request that their personal information be deleted.
Data portability: Consumers can request their data be transferred between organizations.
Algorithmic transparency: Where decisions are made by automated systems, individuals have a right to an explanation.
Privacy management programs: Every organization must implement a documented program proportionate to its size and risk profile.
Breach reporting: Mandatory notification to the Privacy Commissioner and affected individuals for breaches posing real risk of significant harm.

2. The Personal Information and Data Protection Tribunal

Currently, the Office of the Privacy Commissioner of Canada (OPC) can investigate and make recommendations but lacks meaningful enforcement teeth. Bill C-27 changes that by creating a dedicated tribunal with the authority to:

Hear appeals of OPC decisions.
Impose administrative monetary penalties (AMPs) of up to $10 million or 3% of global gross revenue.
Provide a faster, specialized forum compared to going through the Federal Court.

For the most serious offences — such as knowingly using de-identified data to identify an individual — penalties can reach $25 million or 5% of global gross revenue, putting Canada on par with GDPR-level fines.

3. The Artificial Intelligence and Data Act (AIDA)

AIDA introduces Canada's first dedicated federal framework for regulating artificial intelligence. It targets so-called "high-impact AI systems" — those that could materially affect health, safety, employment, or human rights.

Key AIDA obligations include:

Assessing whether a system qualifies as high-impact.
Implementing risk mitigation measures.
Monitoring AI systems for bias and unintended outcomes.
Publishing plain-language descriptions of how systems are used.
Notifying the Minister of any material harms.

Violations of AIDA can attract criminal penalties, including fines and, in extreme cases, imprisonment for executives whose organizations knowingly cause serious harm.

Bill C-27 vs PIPEDA vs GDPR: Quick Comparison

To understand where Bill C-27 sits globally, here's how it compares against PIPEDA (the law it replaces) and the EU's GDPR (the global benchmark):

Feature	PIPEDA (Current)	Bill C-27 (CPPA)	GDPR (EU)
Maximum fines	$100,000	$25M or 5% global revenue	€20M or 4% global revenue
Right to deletion	Limited	Yes (disposal)	Yes (erasure)
Data portability	No	Yes	Yes
Algorithmic transparency	No	Yes	Yes
Children's data protections	General	Sensitive by default	Enhanced rules (under 16)
Enforcement body	OPC (recommendations)	OPC + Tribunal (binding)	National DPAs (binding)
AI regulation	None	Yes (AIDA)	EU AI Act (separate)

Who Does Bill C-27 Apply To?

The CPPA portion of Bill C-27 applies to virtually every private-sector organization that collects, uses, or discloses personal information in the course of commercial activity in Canada — including foreign companies serving Canadian customers. AIDA applies to organizations that design, develop, or make available AI systems used in international or interprovincial trade.

Exemptions include:

Federal government institutions (covered by the Privacy Act).
Provincially regulated organizations in provinces with substantially similar laws (Quebec, Alberta, BC).
Personal or domestic use of data.
Journalistic, artistic, and literary purposes.

Key Rights for Canadians Under Bill C-27

The bill significantly expands the rights individuals have over their own data. Canadians will be able to:

Withdraw consent at any time, with organizations required to honour the request.
Request disposal of their personal information when it's no longer needed.
Transfer their data from one provider to another via standardized data mobility frameworks.
Receive explanations for decisions made by automated systems that significantly affect them.
File complaints with the Privacy Commissioner and seek redress through the new Tribunal.

What Businesses Should Do Now

Even though Bill C-27 has progressed through Parliament in stages and timelines have shifted, prudent organizations should not wait until the law is fully in force. Compliance preparation typically takes 12–24 months, especially for organizations handling large volumes of data or operating AI systems.

1. Conduct a Data Mapping Exercise

Document every category of personal information you collect, why you collect it, where it's stored, who has access, and how long you retain it. You can't protect what you can't see.

2. Update Consent Mechanisms

Review every consent flow — sign-up forms, cookie banners, marketing opt-ins — and rewrite them in plain language. If a reasonable person can't understand what they're agreeing to, it won't pass scrutiny.

3. Build a Privacy Management Program

Appoint a privacy officer, develop written policies, train staff, and document your decisions. This isn't bureaucratic theatre — under the CPPA, it's a legal requirement.

4. Audit Your AI and Automated Decision Systems

If you use algorithms to screen job applicants, approve loans, set prices, or recommend content, you may have obligations under AIDA. Document how systems work, what data they use, and what safeguards are in place.

5. Strengthen Your Security Posture

Bill C-27 doesn't mandate specific technical controls, but it does require "appropriate safeguards." That means encryption at rest and in transit, access controls, regular vulnerability testing, and incident response planning. For organizations handling shared links, redirects, and user data, choosing a privacy-conscious tool like Lunyb for link shortening can reduce exposure compared to platforms that monetize click data. We've covered this in detail in our honest Lunyb review and our 2026 URL shortener buyer's guide.

6. Review Vendor Contracts

Any third party that processes data on your behalf becomes a compliance risk. Update your contracts to include privacy obligations, breach notification timelines, and audit rights.

Penalties and Enforcement

The financial consequences under Bill C-27 are far more severe than under PIPEDA. Here's a breakdown:

Violation Type	Maximum Penalty
Administrative violations (CPPA)	$10M or 3% global revenue
Serious offences (knowingly violating CPPA)	$25M or 5% global revenue
AIDA — regulatory violations	Up to $10M or 3% global revenue
AIDA — criminal offences (causing serious harm)	Up to $25M or 5% global revenue + jail time

These figures place Canada among the strictest jurisdictions globally — even surpassing the GDPR in absolute terms.

Criticisms and Ongoing Debate

Bill C-27 isn't without controversy. Privacy advocates, academics, and industry groups have raised several concerns:

AIDA was introduced with limited consultation and many key definitions are left to future regulations.
The "legitimate interest" exception in the CPPA could allow data processing without consent in ways critics see as too broad.
Children's privacy, while improved, still lacks the specific age-based protections seen in some other jurisdictions.
The Tribunal layer may slow down enforcement compared to giving the OPC direct fining power.

Amendments have been proposed throughout the legislative process, and the final text may differ from earlier drafts. Organizations should monitor the bill's progress and adjust their compliance roadmaps accordingly.

How Bill C-27 Interacts with Provincial Laws

Canada's privacy landscape is a patchwork. Quebec's Law 25, Alberta's PIPA, and BC's PIPA all have their own provincial regimes. Quebec's Law 25, in particular, is already in force and in many ways stricter than Bill C-27.

For national businesses, this means navigating overlapping rules. The good news: Bill C-27 is designed to be "substantially similar" to provincial laws so that organizations operating across Canada can rely on a baseline federal standard, with provincial layers added on top where applicable.

What Happens Next?

As of the most recent legislative activity, Bill C-27 has been working its way through committee review and amendments. Once passed and assented to, the law will likely include a transition period of 12 to 24 months before key provisions are enforceable. That window is your runway — use it wisely.

Frequently Asked Questions

Is Bill C-27 the same as PIPEDA?

No. Bill C-27 will replace Part 1 of PIPEDA with the new Consumer Privacy Protection Act (CPPA), and it adds two entirely new pieces of legislation: the Tribunal Act and the Artificial Intelligence and Data Act. PIPEDA's electronic documents provisions will remain.

When does Bill C-27 come into force?

The exact date depends on Royal Assent and subsequent orders-in-council. Once passed, most provisions will have a transition period — likely 12 to 24 months — before they become fully enforceable. AIDA's substantive obligations may have a longer phase-in.

Does Bill C-27 apply to small businesses?

Yes. The CPPA applies to any organization that collects, uses, or discloses personal information in the course of commercial activity, regardless of size. However, the law allows obligations to be "proportionate" — a small bakery's privacy management program will look very different from a multinational bank's.

How does Bill C-27 affect international companies?

Foreign organizations that offer goods or services to Canadians, or that process Canadian personal information, are subject to the CPPA. This mirrors the extraterritorial reach of the GDPR and means global businesses must factor Canada into their compliance programs.

What's the difference between AIDA and the EU AI Act?

Both regulate "high-impact" or "high-risk" AI systems, but the EU AI Act is far more prescriptive, with detailed risk categories and conformity assessments. AIDA takes a more principles-based approach and leaves much of the detail to forthcoming regulations. Organizations operating in both markets will need to comply with both regimes.

Final Thoughts

Bill C-27 is a generational shift in Canadian privacy and technology law. It raises the stakes significantly — both in terms of individual rights and corporate accountability. Organizations that treat it as a checkbox exercise will be exposed; those that embrace it as an opportunity to build trust will be rewarded.

Start now: map your data, modernize your consent, document your AI, and choose privacy-respecting tools across your stack. The runway between now and full enforcement is shorter than it looks.