Bill C-27 Digital Charter: What You Need to Know

Canada's privacy landscape is undergoing its most significant transformation in more than two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, is set to modernize how organizations across the country collect, use, disclose, and protect personal information — and it introduces Canada's first federal framework for regulating artificial intelligence. If you run a business, handle customer data, or build digital products for Canadian users, understanding Bill C-27 isn't optional.

This guide breaks down what Bill C-27 is, what it changes, who it affects, and how organizations can prepare for a post-PIPEDA regulatory environment.

What Is Bill C-27?

Bill C-27, the Digital Charter Implementation Act, 2022, is a proposed Canadian federal law that would replace the existing Personal Information Protection and Electronic Documents Act (PIPEDA) with a modernized privacy regime and create new rules for artificial intelligence systems. It was introduced in the House of Commons on June 16, 2022, by the Minister of Innovation, Science and Industry.

The bill bundles together three separate pieces of legislation:

1. The Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and establishes new privacy rights for individuals and obligations for private-sector organizations.
2. The Personal Information and Data Protection Tribunal Act (PIDPTA) — creates a new administrative tribunal to review Privacy Commissioner decisions and impose penalties.
3. The Artificial Intelligence and Data Act (AIDA) — Canada's first attempt at regulating high-impact AI systems in the private sector.

Together, these three acts represent the federal government's response to years of criticism that PIPEDA — enacted in 2000 — is outdated for the age of cloud computing, targeted advertising, biometrics, and generative AI.

Why Bill C-27 Matters Now

PIPEDA has long been criticized as under-enforced and out of step with modern global privacy standards like the EU's General Data Protection Regulation (GDPR) and California's CPRA. The European Commission's adequacy decision, which allows personal data to flow freely between the EU and Canada, is up for renewal — and without modernization, Canada risks losing that status.

Bill C-27 also addresses growing public concern over:

• Opaque algorithmic decision-making
• Massive data breaches affecting millions of Canadians
• The commercial use of biometrics and children's data
• The rapid deployment of generative AI systems

For businesses, the stakes are high: proposed penalties under the CPPA are among the steepest of any privacy law globally, reaching up to 5% of global revenue or $25 million CAD — whichever is greater.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the heart of Bill C-27. It replaces PIPEDA's private-sector privacy rules with a rights-based framework that gives Canadians more control over their personal information and imposes clearer obligations on organizations.

Key New Rights for Individuals

• Right to disposal (deletion): Individuals can request that organizations delete their personal information, subject to certain exceptions.
• Right to data mobility: Individuals can request their data be transferred to another organization within a designated framework.
• Right to explanation: When organizations use automated decision-making systems that significantly impact individuals, they must provide a plain-language explanation.
• Enhanced consent standards: Consent must be obtained in plain language and clearly explain purposes, consequences, and third-party disclosures.
• Special protections for minors: Personal information of minors is treated as "sensitive" by default, triggering heightened obligations.

New Obligations for Organizations

• Implement a documented privacy management program proportionate to the volume and sensitivity of data handled.
• Conduct privacy impact assessments before deploying activities that could pose a high risk to individuals.
• Maintain records of processing and be prepared to provide them to the Privacy Commissioner on request.
• Report breaches of security safeguards involving a "real risk of significant harm" to affected individuals and the Commissioner.
• Designate an individual accountable for CPPA compliance (similar to a Data Protection Officer under GDPR).

Legitimate Interest and Business Activities

The CPPA introduces a new "legitimate interest" exception that allows organizations to process personal information without express consent in narrowly defined circumstances — provided a documented assessment shows the benefits outweigh potential adverse impacts. This mirrors GDPR's Article 6(1)(f) but with tighter guardrails.

The Personal Information and Data Protection Tribunal

The PIDPTA creates a new six-member administrative tribunal — the first of its kind in Canadian privacy law — with the power to:

• Review decisions and orders made by the Privacy Commissioner of Canada
• Impose administrative monetary penalties (AMPs) of up to $10 million or 3% of global revenue for certain contraventions
• Hear appeals from organizations and individuals

For the most serious offences — including knowingly using de-identified information to re-identify individuals or obstructing an investigation — courts can impose fines of up to $25 million or 5% of global revenue, whichever is higher.

Comparison: PIPEDA vs. CPPA Penalty Regime

Feature	PIPEDA (Current)	CPPA (Proposed)
Maximum fine	$100,000 CAD	$25M or 5% of global revenue
Administrative penalties	None	Up to $10M or 3% of global revenue
Private right of action	Limited	Expanded — individuals can sue for damages
Dedicated tribunal	No	Yes (PIDPTA)
Order-making powers	Recommendations only	Binding orders from Commissioner

The Artificial Intelligence and Data Act (AIDA)

AIDA is Canada's first federal AI legislation aimed at the private sector. It focuses on "high-impact" AI systems — a category to be defined further by regulation but likely to include systems used in employment, healthcare, biometric identification, content moderation, and critical services.

Core AIDA Obligations

1. Risk assessment: Organizations must assess whether an AI system qualifies as high-impact.
2. Mitigation measures: Establish policies to identify, assess, and mitigate risks of harm and biased output.
3. Monitoring: Continuously monitor compliance and system performance.
4. Transparency: Publish plain-language descriptions of high-impact systems.
5. Record-keeping: Maintain documentation of assessments and mitigation efforts.

AIDA also creates new criminal offences for making an AI system available when the operator knows it is likely to cause serious harm, or for using unlawfully obtained data in AI training.

Enforcement

AIDA introduces the role of the Artificial Intelligence and Data Commissioner, initially situated within the Ministry of Innovation, Science and Industry. Penalties for non-compliance can reach the same $25M / 5% of global revenue threshold as the CPPA.

Who Is Affected by Bill C-27?

The CPPA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities in Canada — much like PIPEDA today. But its reach extends further because of extraterritorial provisions covering foreign organizations that process the data of Canadians.

Specifically affected groups include:

• Canadian businesses of all sizes (with some accommodations for small organizations)
• Foreign companies offering goods or services to Canadians
• SaaS providers, cloud services, and data processors
• Marketing and advertising technology firms
• AI developers, deployers, and operators of high-impact systems
• Financial institutions, healthcare providers, and educational technology companies

How to Prepare: A Practical Checklist

Even though Bill C-27 has not yet received Royal Assent as of this writing, the direction of Canadian privacy reform is clear. Organizations that wait for the final text risk scrambling once the transition period begins. Here's a practical roadmap:

1. Map your data. Know what personal information you collect, where it lives, how long you keep it, and who has access.
2. Audit consent flows. Rewrite privacy notices in plain language. Ensure consent requests specify purposes and third parties.
3. Establish a privacy management program. Assign accountability, document policies, and train employees.
4. Prepare for new individual rights. Build processes to handle deletion, access, and data mobility requests within reasonable timelines.
5. Inventory AI systems. Identify any automated decision-making or high-impact AI systems, and document how they work.
6. Update breach response plans. Ensure your incident response can meet the "real risk of significant harm" reporting threshold quickly.
7. Review vendor contracts. Data processing agreements should reflect CPPA obligations, including transfer safeguards.
8. Strengthen technical safeguards. Encryption, access controls, minimization, and de-identification should be standard practice.

Privacy by Design in Everyday Tools

Bill C-27 rewards organizations that build privacy into their tools from the start — not as an afterthought. This means every operational choice, from customer analytics platforms to link-sharing services, deserves scrutiny.

For example, when businesses share URLs in marketing campaigns, customer support tickets, or internal communications, the shortening service they use may collect click data, IP addresses, and referrer information. Choosing a privacy-respecting URL shortener like Lunyb — which emphasizes minimal data collection and transparent analytics — is a small but meaningful example of privacy-by-design thinking. You can read more about how it stacks up in our honest Lunyb review or compare options in our 2026 URL shortener buyer's guide.

How Bill C-27 Compares to Global Privacy Laws

Feature	CPPA (Canada)	GDPR (EU)	CPRA (California)
Max fine	5% of global revenue / $25M CAD	4% of global revenue / €20M	$7,500 per intentional violation
Right to deletion	Yes	Yes	Yes
Data portability	Yes (framework-based)	Yes	Yes
AI-specific rules	Yes (via AIDA)	Yes (AI Act, separate law)	Limited
Dedicated regulator	OPC + AI Commissioner	National DPAs + EDPB	CPPA (California)
Private right of action	Yes	Yes	Limited (breach only)

Criticism and Ongoing Debate

Bill C-27 has not been without controversy. Privacy advocates, academics, and civil society groups have raised concerns including:

• Insufficient recognition of privacy as a fundamental right in the CPPA's preamble (though amendments to address this have been proposed).
• Weaker protections for children than in some jurisdictions.
• The tribunal structure, which some argue adds delays and reduces the Privacy Commissioner's authority.
• AIDA's vagueness — critical terms like "high-impact" are left to future regulation, making the law hard to assess in advance.

The bill has progressed through committee stages with numerous amendments proposed. Organizations should watch for the final text closely, as substantive changes may still occur before it becomes law.

Frequently Asked Questions

When will Bill C-27 come into force?

Bill C-27 has not yet received Royal Assent. Once enacted, the CPPA and PIDPTA are expected to have a transition period (likely one to two years), while AIDA has been proposed to come into force no earlier than 2025, with core obligations phased in over subsequent years.

Does Bill C-27 replace PIPEDA entirely?

The CPPA replaces Part 1 of PIPEDA (the private-sector privacy rules). Part 2 of PIPEDA, which deals with electronic documents, remains in effect. Provincial privacy laws in Quebec, British Columbia, and Alberta continue to apply where deemed substantially similar.

How large are the penalties under Bill C-27?

Administrative monetary penalties under the CPPA can reach $10 million CAD or 3% of global revenue, whichever is higher. For serious offences prosecuted in court, fines can reach $25 million CAD or 5% of global revenue — among the highest in the world.

Does Bill C-27 apply to small businesses?

Yes, but with proportionality built in. Small organizations must still comply with core CPPA obligations, but the required privacy management program can be scaled to the volume and sensitivity of personal information handled. The Privacy Commissioner is expected to publish guidance for small businesses.

What should Canadian businesses do right now?

Start by mapping personal data flows, updating consent notices, reviewing vendor contracts, and inventorying any automated decision-making systems. Assign clear accountability for privacy compliance, and monitor the bill's progress so you can align policies quickly once final regulations are published.

Final Thoughts

Bill C-27 marks a turning point for Canadian privacy and AI governance. Whether you view it as overdue modernization or overreach, its impact on how organizations handle personal information will be profound. The organizations best positioned to thrive are those that treat privacy not as a compliance box to tick, but as a core design principle — one that builds trust with customers, partners, and regulators alike.

Now is the time to assess your data practices, close gaps, and lay the groundwork for a Canadian privacy regime that finally has teeth.