Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's approach to privacy and artificial intelligence is undergoing its most significant transformation in more than two decades. At the centre of this shift sits Bill C-27, the Digital Charter Implementation Act, a sweeping piece of federal legislation that will replace outdated privacy rules with a modern framework designed for an AI-driven, data-heavy economy.

Whether you run a small online business in Toronto, manage IT compliance for a Vancouver enterprise, or simply want to understand your rights as a Canadian consumer, this guide breaks down everything you need to know about Bill C-27, its three component acts, expected penalties, and how to prepare.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is Canadian federal legislation introduced to modernise the country's privacy laws and, for the first time, establish binding rules for artificial intelligence systems. It bundles three separate but connected statutes into one package.

The bill is designed to replace the private-sector provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), which has governed Canadian commercial privacy since 2000. In an era of generative AI, cross-border data flows, and increasingly sophisticated cyber threats, PIPEDA has been widely seen as insufficient. Bill C-27 is Ottawa's answer.

The Three Acts Inside Bill C-27

Consumer Privacy Protection Act (CPPA) — the new core privacy law for private-sector organisations.
Personal Information and Data Protection Tribunal Act (PIDPTA) — creates a specialised tribunal to hear appeals and impose administrative penalties.
Artificial Intelligence and Data Act (AIDA) — Canada's first federal law dedicated to regulating high-impact AI systems.

Why Bill C-27 Matters

The stakes are considerable. Canada is under pressure to maintain "adequacy" status with the European Union under the GDPR, ensure interoperability with emerging U.S. state privacy laws, and reassure Canadians that their personal information is protected in an environment where data breaches and AI-driven decision-making are now everyday realities.

For businesses, non-compliance could mean fines that dwarf anything possible under PIPEDA. For consumers, Bill C-27 introduces new rights — including the right to erasure, algorithmic transparency, and clearer consent — that align Canadian law more closely with global privacy standards.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the backbone of Bill C-27. It rewrites how organisations across Canada must collect, use, disclose, and safeguard personal information in the course of commercial activity.

Key CPPA Requirements

Meaningful consent: Organisations must obtain clear, plain-language consent before collecting personal data, with specific disclosures about purpose, recipients, and reasonable consequences.
Right to disposal (erasure): Canadians can request that businesses delete their personal information, subject to limited exceptions.
Data mobility: Individuals can request their data be transferred between designated organisations.
Algorithmic transparency: Where automated decision systems make predictions or recommendations that could significantly affect someone, businesses must explain how the decision was reached.
Privacy management programs: Every organisation must maintain a documented privacy program appropriate to the volume and sensitivity of data it handles.
Breach reporting: Mandatory notification to the Privacy Commissioner and affected individuals for any breach posing a real risk of significant harm.
Special protection for minors: Information about individuals under the age of majority is automatically classified as "sensitive," triggering stricter rules.

Penalties Under the CPPA

The financial consequences are dramatic compared to PIPEDA:

Violation Type	Maximum Administrative Penalty	Maximum Criminal Fine
Serious contraventions (e.g. unauthorised use of data)	3% of global revenue or CAD $10 million (whichever is higher)	—
Most serious offences (e.g. obstructing investigation, concealing breach)	—	5% of global revenue or CAD $25 million (whichever is higher)
PIPEDA (for comparison)	CAD $100,000 per violation	CAD $100,000

The Artificial Intelligence and Data Act (AIDA)

AIDA is arguably the most novel — and most debated — component of Bill C-27. It establishes a risk-based framework for the design, development, and deployment of AI systems in Canada.

What Counts as a "High-Impact" AI System?

AIDA focuses regulatory attention on "high-impact" AI systems. Government amendments have proposed defining these across categories such as:

Employment screening and workplace management
Provision of essential services (credit, insurance, housing)
Biometric identification and inference of emotional or behavioural states
Content moderation and prioritisation on large platforms
Healthcare decision support
Law enforcement and immigration processing

AIDA Obligations for Businesses

Assess whether an AI system qualifies as high-impact.
Establish measures to identify, assess, and mitigate risks of harm or biased output.
Monitor compliance with mitigation measures on an ongoing basis.
Publish plain-language descriptions of the system's purpose, capabilities, and limitations.
Report material harm to the Minister of Innovation, Science and Industry.
Keep records demonstrating compliance.

AIDA Penalties

Regulatory penalties under AIDA can reach up to 3% of global revenue or CAD $10 million, with criminal offences (such as knowingly making an AI system available that causes serious harm) attracting fines of up to 5% of global revenue or CAD $25 million and, in some cases, imprisonment.

The Personal Information and Data Protection Tribunal

Under PIPEDA, complaints move through the Office of the Privacy Commissioner and then, if necessary, into Federal Court — a slow and expensive process. Bill C-27 changes this by creating a specialised Personal Information and Data Protection Tribunal.

The Tribunal will:

Hear appeals of the Privacy Commissioner's findings and orders.
Impose the substantial administrative monetary penalties authorised under the CPPA.
Provide a faster, more accessible venue for privacy disputes.

Members will include individuals with expertise in information and privacy law, giving decisions a level of technical grounding that general courts often lack.

How Bill C-27 Compares to PIPEDA and GDPR

Feature	PIPEDA (current)	Bill C-27 / CPPA	EU GDPR
Maximum fine	$100,000	5% global revenue or $25M	4% global revenue or €20M
Right to erasure	Limited	Yes	Yes
Data portability	No	Yes (framework-based)	Yes
Algorithmic transparency	No	Yes	Yes (Art. 22)
AI-specific rules	No	Yes (AIDA)	Handled separately (EU AI Act)
Dedicated tribunal	No	Yes	National DPAs
Enhanced protection for minors	No explicit provision	Yes (sensitive by default)	Yes

What Bill C-27 Means for Canadian Businesses

Preparation should begin now, even while the bill continues its parliamentary journey. The compliance burden will be significant, particularly for organisations that have relied on PIPEDA's lighter-touch enforcement.

Pros of the New Framework

Greater alignment with GDPR eases cross-border operations.
A tribunal-based system may reduce litigation costs long-term.
Clear AI rules provide certainty for responsible innovators.
Codes of practice allow industry-specific flexibility.

Cons and Concerns

Compliance costs will rise sharply for SMEs.
AIDA's definitions of "high-impact" have been criticised as vague.
Overlapping obligations with provincial laws (Quebec's Law 25, Alberta's PIPA, B.C.'s PIPA) create complexity.
Enforcement timelines and Tribunal procedures remain uncertain until regulations are finalised.

A Practical Compliance Checklist

Inventory your data. Map every category of personal information you collect, where it is stored, who accesses it, and why.
Review consent mechanisms. Rewrite privacy notices in plain language and separate purposes clearly.
Appoint a privacy officer. The CPPA requires designated accountability, even for small businesses.
Document a privacy management program. Include policies, training, complaint procedures, and breach response.
Audit third-party service providers. You remain accountable for data transferred to processors.
Assess AI usage. Identify any system that could qualify as high-impact under AIDA and begin building mitigation records.
Prepare for data subject requests. Build workflows to handle access, correction, disposal, and portability requests within reasonable timeframes.
Test your breach response plan. Ensure you can meet mandatory reporting timelines.

What Bill C-27 Means for Consumers

Canadians will gain meaningful new controls over their personal information. If a company uses an automated system to deny you a loan, filter your job application, or moderate your content, you will have the right to ask how that decision was made. You will also be able to request that businesses delete data they no longer need.

For everyday online activity, Canadians can further protect themselves by adopting privacy-forward tools: encrypted messaging apps, privacy-respecting browsers, encrypted DNS resolvers, and trusted link-management services. For example, when sharing links in emails, on social media, or in newsletters, using a reputable shortener such as Lunyb — reviewed in our honest 2026 review — helps you control click analytics, avoid exposing sensitive query parameters, and disable links if they are compromised. Compare options in our 2026 buyer's guide to find the right fit.

Where Bill C-27 Stands Today

Bill C-27 has moved through Second Reading and committee study in the House of Commons, but its path has been complicated by extensive amendments, particularly to AIDA. Parliamentary disruptions have delayed final passage, and observers expect a reintroduced or substantially revised version to advance in the current sitting. Businesses should treat the bill as a matter of "when," not "if."

Once passed, most CPPA provisions will come into force following an implementation period — likely 12 to 24 months — giving organisations time to adapt. AIDA is expected to have its own longer runway, with major obligations phased in as regulations are finalised.

How Bill C-27 Interacts With Provincial Laws

Canada's privacy landscape is famously layered. Quebec's Law 25 already imposes GDPR-style rules on organisations doing business in the province, including significant penalties and mandatory privacy impact assessments. Alberta and British Columbia have their own private-sector privacy acts. Bill C-27 will apply federally except where a province has "substantially similar" legislation.

The practical result: national organisations must build compliance frameworks flexible enough to satisfy the strictest applicable standard in each jurisdiction.

Frequently Asked Questions

When will Bill C-27 come into force?

No date has been fixed. The bill must first complete its passage through Parliament, receive Royal Assent, and then wait for its coming-into-force order. Most legal analysts expect a transition period of 12 to 24 months after Royal Assent before CPPA obligations become enforceable, with AIDA following on a slightly longer timeline.

Does Bill C-27 apply to small businesses?

Yes. Unlike some jurisdictions that exempt very small organisations, the CPPA applies to any organisation that collects, uses, or discloses personal information in the course of commercial activity. However, the required scale of a privacy management program is proportionate to the volume and sensitivity of the data handled, giving small businesses some flexibility in how they comply.

How is AIDA different from the EU AI Act?

Both take risk-based approaches, but AIDA is narrower and less prescriptive. The EU AI Act defines specific tiers (unacceptable, high, limited, minimal risk) with detailed conformity assessments. AIDA focuses primarily on "high-impact" systems and delegates much of the detail to future regulations, giving Canadian regulators more flexibility but leaving businesses with less immediate certainty.

What rights will I have as a Canadian consumer?

Under the CPPA, you will have the right to access your personal information, request corrections, request disposal (erasure), receive an explanation of automated decisions that significantly affect you, and, in certain cases, request that your data be transferred to another organisation. You will also benefit from stronger breach notification requirements.

What happens if my organisation fails to comply?

The Privacy Commissioner will have expanded investigative and order-making powers. Serious contraventions can lead to administrative penalties of up to 3% of global revenue or CAD $10 million, and the most serious offences can result in criminal fines of up to 5% of global revenue or CAD $25 million. The Personal Information and Data Protection Tribunal will handle penalty decisions and appeals.

Final Thoughts

Bill C-27 represents a generational shift in Canadian privacy and AI regulation. For businesses, it demands early, deliberate preparation — from data mapping and consent redesign to AI risk assessments and staff training. For consumers, it promises stronger, more modern rights that finally reflect how personal information moves through today's digital economy.

The organisations that treat compliance as a strategic advantage — rather than a checkbox — will be best placed to earn trust, avoid penalties, and thrive under Canada's new digital charter.