Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is on the verge of its biggest transformation in over two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, aims to modernize how Canadian organizations collect, use, and safeguard personal information—while introducing the country's first federal framework for artificial intelligence. If you run a business, handle customer data, or simply care about your digital rights, understanding this legislation is essential.

What Is Bill C-27?

Bill C-27 is a proposed Canadian federal law that would replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modernized privacy regime and introduce new rules governing artificial intelligence. Introduced in June 2022 by the Minister of Innovation, Science and Industry, it forms the legislative backbone of Canada's broader Digital Charter initiative.

The bill bundles three distinct pieces of legislation into one package:

The Consumer Privacy Protection Act (CPPA) — replaces the private-sector portions of PIPEDA.
The Personal Information and Data Protection Tribunal Act — creates a new administrative tribunal to review privacy decisions and impose penalties.
The Artificial Intelligence and Data Act (AIDA) — Canada's first federal law targeting high-impact AI systems.

Together, these three components represent a coordinated effort to bring Canadian data protection standards closer to global benchmarks like the EU's General Data Protection Regulation (GDPR) while addressing new challenges posed by machine learning and automated decision-making.

Why Bill C-27 Matters

PIPEDA has been in force since 2000 and was drafted for an internet vastly different from today's. Cloud computing, mobile apps, cross-border data flows, biometric identification, and generative AI simply weren't part of the original picture. Meanwhile, Canada's adequacy status with the European Union—which allows the free flow of personal data between the two jurisdictions—depends on Canada maintaining privacy laws considered "essentially equivalent" to the GDPR. Without modernization, that status is at risk.

For Canadian businesses, the stakes are significant. Non-compliance under the proposed CPPA could result in some of the steepest privacy penalties in the world, and the AIDA introduces obligations that many organizations have never had to consider before.

The Three Pillars of Bill C-27 Explained

1. The Consumer Privacy Protection Act (CPPA)

The CPPA is the centrepiece of Bill C-27. It updates consent rules, expands individual rights, and dramatically increases enforcement power. Key features include:

Plain-language consent: Organizations must explain data practices in language a target audience would reasonably understand.
Right to disposal: Individuals can request that their personal information be deleted, subject to legal exceptions.
Data mobility: Consumers can request that their information be transferred between organizations within designated frameworks.
Algorithmic transparency: Individuals can request explanations of predictions, recommendations, or decisions made about them by automated systems.
Enhanced protections for minors: The information of children is deemed "sensitive" by default, triggering stricter handling requirements.
De-identified and anonymized data: Clear definitions and different obligations for each category.

2. The Personal Information and Data Protection Tribunal Act

This creates a new six-member Personal Information and Data Protection Tribunal. Its role is to hear appeals of decisions made by the Privacy Commissioner of Canada and to impose administrative monetary penalties. This structure separates investigation (handled by the Commissioner) from adjudication (handled by the Tribunal), aiming to add procedural fairness while enabling meaningful enforcement.

3. The Artificial Intelligence and Data Act (AIDA)

AIDA would be Canada's first federal AI law. It focuses on "high-impact" AI systems—a category to be further defined in regulations, but expected to include systems used in employment, healthcare, essential services, biometric identification, content moderation, and law enforcement contexts. Obligations under AIDA include:

Assessing whether an AI system qualifies as high-impact.
Establishing measures to identify, assess, and mitigate risks of harm or biased output.
Monitoring compliance and the effectiveness of those measures.
Publishing plain-language descriptions of the system on a public-facing site.
Notifying the Minister of material harm resulting from the AI system.

Penalties: How Serious Are the Consequences?

Bill C-27 introduces the highest privacy fines Canada has ever seen. Understanding these numbers helps clarify why compliance matters.

Violation Type	Maximum Administrative Penalty	Maximum Fine on Conviction
CPPA — non-compliance (administrative)	3% of global revenue or CA$10 million (whichever is higher)	—
CPPA — serious offences	—	5% of global revenue or CA$25 million (whichever is higher)
AIDA — regulatory offences	Up to CA$10 million or 3% of global revenue	Up to CA$25 million or 5% of global revenue
AIDA — criminal offences (e.g., reckless deployment causing serious harm)	—	Fines at the discretion of the court; possible imprisonment

These figures rival, and in some cases exceed, penalties under the GDPR. For small and mid-sized Canadian businesses, even a percentage of global revenue can be existential.

Who Does Bill C-27 Apply To?

The CPPA applies to organizations that collect, use, or disclose personal information in the course of commercial activities across provincial or national borders, or in any province without substantially similar privacy legislation. AIDA applies to persons involved in "international or interprovincial trade and commerce" who design, develop, make available, or manage the operation of AI systems.

In practical terms, most private-sector organizations operating in Canada—from national retailers to SaaS startups, marketing agencies, healthcare technology providers, and financial services firms—will fall within scope. Provinces with their own "substantially similar" laws (currently Quebec, Alberta, and British Columbia) may retain jurisdiction for intra-provincial activity, though the CPPA still applies to cross-border data flows.

Key Differences from PIPEDA

While Bill C-27 builds on PIPEDA's foundation, several changes represent a substantial shift in obligations.

Area	PIPEDA (current)	CPPA (proposed under Bill C-27)
Maximum fine	CA$100,000 per violation	Up to 5% of global revenue or CA$25M
Right to deletion	Limited	Explicit "right to disposal"
Data portability	Not addressed	Data mobility framework
Automated decisions	Not addressed	Right to an explanation
Enforcement body	Commissioner (recommendations only)	Commissioner + Tribunal (binding orders and penalties)
Minors' data	Not specifically defined	Treated as sensitive by default
De-identification	No formal definition	Defined with specific obligations

Business Impact: How Bill C-27 Changes Day-to-Day Operations

If Bill C-27 passes in its current or amended form, most Canadian organizations will need to revisit multiple aspects of their data operations.

1. Privacy Policies and Consent Flows

Consent language must be clear, specific, and understandable. Long, jargon-heavy privacy policies will no longer meet the standard. Organizations should audit sign-up flows, cookie banners, and account settings.

2. Data Mapping and Records of Processing

You cannot protect what you cannot see. A complete inventory of data types, storage locations, retention periods, and third-party recipients becomes essential—especially to respond to disposal or mobility requests.

3. Vendor and Service-Provider Agreements

Contracts with processors must ensure equivalent protection when personal information is transferred. This includes analytics tools, marketing platforms, payment processors, cloud hosts, and even short-link and tracking services. If you use link management tools, choose ones that respect privacy by design—for example, Lunyb is a privacy-conscious URL shortener that offers analytics without invasive tracking, which can simplify compliance conversations. You can read more in our honest review of Lunyb or explore our 2026 buyer's guide to URL shorteners.

4. AI Governance

For organizations building or deploying AI, AIDA introduces a governance layer that includes impact assessments, bias mitigation, documentation, and public transparency. Even if your system doesn't qualify as "high-impact," building governance practices now is prudent.

5. Breach Response

Breach notification obligations remain, but the higher penalty ceiling means incident-response planning becomes more urgent. Regular tabletop exercises and clearly defined escalation paths are recommended.

A Practical Compliance Roadmap

Getting ready for Bill C-27 doesn't require reinventing your program overnight. A phased approach works well:

Assess: Conduct a gap analysis against CPPA and AIDA requirements.
Map: Build or refresh a data inventory covering all personal information and any AI systems in use.
Update policies: Rewrite privacy notices in plain language and revise consent mechanisms.
Strengthen contracts: Add C-27-ready clauses to vendor and processor agreements.
Implement rights workflows: Create processes for access, correction, disposal, mobility, and algorithmic-explanation requests.
Train staff: Provide role-based training, particularly for engineering, marketing, HR, and customer support.
Establish AI governance: Assign accountability, document systems, and define risk-assessment protocols.
Monitor and iterate: Privacy programs require continuous review. Set a cadence for audits and metrics.

Where Bill C-27 Stands Today

As of 2026, Bill C-27 has progressed through multiple readings and committee review, with amendments proposed to strengthen consumer protections, tighten AI definitions, and clarify the Tribunal's role. Passage timelines depend on parliamentary priorities, but many observers expect elements of the bill—particularly the CPPA and Tribunal Act—to become law within the current legislative cycle, potentially followed by AIDA with a phased implementation period.

Even if the final text changes, the direction of travel is clear: stronger consumer rights, higher penalties, and formal AI oversight. Organizations that wait until passage to begin preparing will likely find themselves scrambling.

What Individuals Should Know

Bill C-27 also empowers Canadians as data subjects. Under the CPPA, you would gain clearer rights to:

Access the personal information organizations hold about you.
Request corrections or deletion.
Move your data between service providers within designated schemes.
Receive plain-language explanations of automated decisions that significantly affect you.
File complaints and have them adjudicated with real enforcement teeth.

In the meantime, practical privacy hygiene still matters: use unique passwords, enable multi-factor authentication, favour encrypted DNS services, review app permissions regularly, and be selective about the platforms you trust with sensitive information.

FAQ

Is Bill C-27 the same as PIPEDA?

No. Bill C-27 would replace the private-sector portions of PIPEDA with the Consumer Privacy Protection Act (CPPA), while also introducing a new Tribunal and Canada's first federal AI law (AIDA). PIPEDA's provisions related to electronic documents would remain.

When will Bill C-27 come into force?

As of 2026, the bill is still moving through Parliament. Even after passage, organizations are expected to receive a transition period—likely 12 to 24 months for CPPA obligations and potentially longer for AIDA—so they can adapt policies, systems, and vendor arrangements.

Does Bill C-27 apply to small businesses?

Yes. There is no small-business exemption under the CPPA. However, obligations are meant to be scaled to the sensitivity of the data and the size of the organization. Small businesses should still perform a gap analysis, since fines are calculated as a percentage of global revenue or a fixed dollar amount—whichever is higher.

How does Bill C-27 compare to the GDPR?

The CPPA aligns with many GDPR principles—consent, transparency, individual rights, and significant fines—but there are differences. For example, the GDPR requires lawful bases beyond consent, mandates Data Protection Officers in some cases, and has broader extraterritorial scope. Bill C-27 is designed in part to preserve Canada's EU adequacy status.

What should organizations do right now?

Start with a data inventory, review privacy notices, tighten vendor contracts, and establish an AI governance framework if you build or deploy AI systems. Early preparation is cheaper and less disruptive than retrofitting compliance after enforcement begins.

Final Thoughts

Bill C-27 represents Canada's most ambitious effort to modernize digital rights and responsibilities in a generation. Whether you're a business leader, developer, marketer, or engaged citizen, understanding its three pillars—CPPA, the Tribunal Act, and AIDA—will help you navigate what's coming. The organizations that thrive under the new regime will be those that treat privacy and AI governance not as compliance burdens, but as foundational elements of trust with their customers.