Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is undergoing its most significant transformation in more than two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, is a sweeping piece of legislation that would modernize how organizations collect, use, and disclose personal information, while also introducing Canada's first federal framework for artificial intelligence. For businesses operating in Canada and the Canadians whose data they handle, understanding Bill C-27 is no longer optional, it is essential.

This guide breaks down what Bill C-27 contains, who it affects, what rights it creates, and how organizations should prepare, even as the bill continues to evolve through Parliament.

What Is Bill C-27?

Bill C-27 is a federal Canadian statute that bundles three distinct pieces of legislation into a single reform package aimed at modernizing digital and data governance. It was introduced in June 2022 by the Minister of Innovation, Science and Industry and is designed to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA), which has governed private-sector privacy in Canada since 2000.

The bill is comprised of three major components:

The Consumer Privacy Protection Act (CPPA) — a modernized private-sector privacy law.
The Personal Information and Data Protection Tribunal Act — creating a new tribunal to handle penalties and appeals.
The Artificial Intelligence and Data Act (AIDA) — Canada's first federal statute regulating high-impact AI systems.

Together, these three acts form the backbone of what the federal government calls the "Digital Charter," a 10-principle framework introduced in 2019 to guide Canada's digital and data strategy.

Why Bill C-27 Matters

PIPEDA was drafted in a pre-smartphone, pre-cloud, pre-generative-AI world. It lacks meaningful enforcement tools, has no provisions for algorithmic decision-making, and offers limited rights for individuals. Bill C-27 addresses these gaps by introducing:

Administrative monetary penalties of up to $10 million or 3% of global revenue, whichever is greater.
Fines for serious offences of up to $25 million or 5% of global revenue.
New rights for Canadians, including data portability and algorithmic transparency.
Stronger consent requirements and clearer rules around de-identified and anonymized data.
Specific protections for the personal information of minors, which the bill explicitly deems "sensitive."

For context, PIPEDA's maximum penalties were effectively symbolic. Bill C-27 brings Canada closer to international peers like the EU's GDPR in terms of enforcement weight.

The Consumer Privacy Protection Act (CPPA)

The CPPA is the centerpiece of Bill C-27. It would repeal and replace Part 1 of PIPEDA, governing how private-sector organizations handle personal information in the course of commercial activity.

Key Changes Under the CPPA

Plain-language consent: Organizations must obtain consent in clear, understandable language at or before the time of collection.
Right to disposal: Individuals can request that their personal information be deleted, subject to limited exceptions.
Data mobility: Canadians will be able to request that their data be transferred to another organization within designated frameworks.
Algorithmic transparency: Organizations using automated decision systems that could significantly impact individuals must provide an explanation on request.
De-identification rules: The CPPA distinguishes between de-identified data (still personal information) and anonymized data (not personal information), with specific obligations for each.
Codes of practice and certification: Industry sectors can develop codes approved by the Privacy Commissioner.

Expanded Powers of the Privacy Commissioner

Under the CPPA, the Office of the Privacy Commissioner of Canada (OPC) gains significantly expanded powers, including the ability to:

Issue binding orders requiring organizations to stop certain activities or comply with the law.
Conduct proactive audits.
Recommend administrative monetary penalties to the new tribunal.

The Personal Information and Data Protection Tribunal

Bill C-27 creates a new quasi-judicial body: the Personal Information and Data Protection Tribunal. Its role is to:

Hear appeals of orders issued by the Privacy Commissioner.
Impose administrative monetary penalties recommended by the Commissioner.
Provide a specialized forum for resolving privacy disputes.

This two-tier structure (Commissioner investigates, Tribunal penalizes) is designed to separate investigative and adjudicative functions, but it has drawn criticism from some privacy advocates who argue it may slow enforcement.

The Artificial Intelligence and Data Act (AIDA)

AIDA is arguably the most groundbreaking, and controversial, part of Bill C-27. It would be Canada's first federal law specifically regulating artificial intelligence systems.

What AIDA Covers

AIDA focuses on "high-impact" AI systems, a term the bill leaves largely to regulations to define. Based on government companion documents, high-impact systems likely include AI used in:

Employment decisions (hiring, promotion, termination).
Access to essential services (credit, insurance, healthcare).
Biometric identification.
Content moderation and recommendation systems at scale.
Law enforcement and public safety.

AIDA Obligations

Organizations designing, developing, or deploying high-impact AI systems would be required to:

Assess and mitigate risks of harm and biased output.
Maintain records of how the system was developed and tested.
Publish plain-language descriptions of the system's purpose and capabilities.
Notify the Minister of serious harm.
Comply with orders from a new AI and Data Commissioner.

Penalties for AIDA violations can reach $25 million or 5% of global revenue, and the act creates new criminal offences for making an AI system available knowing it is likely to cause serious harm.

Bill C-27 vs. PIPEDA vs. GDPR: A Comparison

To understand where Bill C-27 fits globally, here's how it compares to the current Canadian law (PIPEDA) and the EU's General Data Protection Regulation (GDPR):

Feature	PIPEDA (current)	Bill C-27 / CPPA	GDPR (EU)
Maximum fines	$100,000 (rarely used)	$25M or 5% global revenue	€20M or 4% global revenue
Right to deletion	Limited	Yes (right to disposal)	Yes (right to erasure)
Data portability	No	Yes (via frameworks)	Yes
Algorithmic transparency	No	Yes	Yes (Article 22)
AI-specific regulation	No	Yes (AIDA)	Separate EU AI Act
Special protections for minors	No explicit rules	Yes (deemed sensitive)	Yes
Enforcement body	Privacy Commissioner (recommendations only)	Commissioner + Tribunal	National DPAs

Who Does Bill C-27 Apply To?

The CPPA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities across Canada, or in connection with the operation of a federal work, undertaking, or business. It also applies to international organizations handling data of Canadians.

Provinces with "substantially similar" privacy laws, currently Quebec, British Columbia, and Alberta, may continue to operate under their own frameworks for intra-provincial activity. Notably, Quebec's Law 25 is already in force and shares many principles with the CPPA.

AIDA applies to any person or organization that designs, develops, makes available, or manages the operation of an AI system in the course of international or interprovincial trade and commerce.

What Rights Will Canadians Gain?

If passed, Bill C-27 would give Canadians a stronger set of digital rights, including:

Clearer consent: Organizations must explain in plain language what data they collect and why.
Right to disposal: Request deletion of personal information.
Right to explanation: Understand how an automated decision was made about you.
Data mobility: Move your data between service providers.
Right to withdraw consent: With reasonable notice and subject to legal or contractual restrictions.
Enhanced protections for minors: Stricter rules around collecting and processing children's data.

How Businesses Should Prepare

Even though Bill C-27 is still working its way through Parliament, prudent organizations should begin preparing now. Compliance programs cannot be built overnight, and many of the CPPA's requirements mirror obligations already in place under Quebec's Law 25 and the GDPR.

Practical Compliance Steps

Map your data: Know what personal information you collect, where it is stored, who has access, and how long you retain it.
Update privacy policies: Rewrite consent language in plain, accessible terms.
Appoint accountable personnel: Designate a privacy officer and, where relevant, an AI accountability lead.
Build a breach response plan: Document procedures for detection, containment, notification, and record-keeping.
Assess automated decision systems: Inventory AI tools and evaluate potential impacts on individuals.
Review vendor contracts: Ensure third-party processors meet CPPA-level obligations.
Minimize data collection: Collect only what you genuinely need, including when using tools that generate URLs, analytics tokens, or tracking parameters.

Rethinking the Tools You Use

Compliance isn't only about policies, it's also about the tools you deploy. Marketing stacks, analytics platforms, and even link shorteners can quietly accumulate personal information through click tracking, IP logging, and device fingerprinting. When choosing vendors, favour those with transparent data practices and minimal collection by default.

For example, if your organization uses short links in email campaigns, social posts, or internal communications, consider whether your provider's data practices align with CPPA principles. Privacy-conscious options like Lunyb focus on minimal data collection while still offering the analytics teams need, a useful contrast to platforms that monetize behavioural data. For a broader market view, our 2026 buyer's guide to URL shorteners compares the major providers on privacy and features.

Criticisms and Open Questions

Bill C-27 has not been without controversy. Common criticisms include:

AIDA was drafted without broad consultation and leaves most substantive rules to future regulations.
The two-tier enforcement model (Commissioner plus Tribunal) may delay meaningful penalties.
Exceptions to consent for "legitimate interest" and "business activities" are seen by some as too broad.
Children's privacy, while improved, still lacks a dedicated code comparable to the UK's Age Appropriate Design Code.
Interaction with provincial laws, especially Quebec's Law 25, creates compliance complexity for national organizations.

Amendments have been proposed throughout committee study, and the final text may differ from the version introduced in 2022. Organizations should monitor developments through the OPC and Parliamentary committee reports.

When Will Bill C-27 Take Effect?

As of 2026, Bill C-27 has moved through multiple stages of parliamentary review but has faced delays due to amendments, prorogation, and political cycles. If and when it receives Royal Assent, most provisions are expected to come into force on a staggered basis, with the government typically providing a transition period (often 12 to 24 months) for organizations to achieve compliance. AIDA in particular is expected to be phased in alongside detailed regulations.

Regardless of exact timing, the direction of travel is clear: stronger privacy rights, meaningful penalties, and dedicated AI governance are coming to Canada.

Frequently Asked Questions

Is Bill C-27 law yet?

Not yet. Bill C-27 has progressed through readings and committee study in the House of Commons but has not received Royal Assent as of early 2026. Its status can change with parliamentary sessions and amendments, so check official sources like LEGISinfo for the most current status.

Does Bill C-27 replace PIPEDA entirely?

It replaces Part 1 of PIPEDA (the private-sector privacy provisions) with the Consumer Privacy Protection Act. The electronic documents provisions of PIPEDA would be moved into a separate renamed act. Public-sector privacy remains governed by the federal Privacy Act, which is being modernized separately.

How does Bill C-27 affect small businesses?

The CPPA applies to organizations of all sizes engaged in commercial activity. However, obligations are generally proportionate to the sensitivity and volume of data handled. Small businesses should focus on fundamentals: clear consent, secure storage, breach response, and honoring individual requests. The penalties, while large in theory, are discretionary and based on factors including the organization's size and intent.

What is the difference between de-identified and anonymized data under the CPPA?

De-identified data has had direct identifiers removed but could still be re-identified under certain conditions, and is treated as personal information with specific safeguards. Anonymized data has been irreversibly modified so that no individual can be identified, directly or indirectly, and falls outside the CPPA's scope. The distinction matters: anonymization is a higher bar than de-identification.

How is AIDA different from the EU AI Act?

Both regulate high-risk or high-impact AI systems, but AIDA is more principles-based and leaves most specifics to regulations, while the EU AI Act is prescriptive and categorizes AI systems into defined risk tiers. The EU Act is also already in force, whereas AIDA remains part of a broader bill still pending in Canada.

Final Thoughts

Bill C-27 represents a long-overdue modernization of Canadian privacy law and a cautious first step into AI regulation. Whether or not every clause survives parliamentary review, the shift toward stronger rights, real penalties, and algorithmic accountability is here to stay. Organizations that treat privacy as a core design principle, rather than a last-minute checklist, will be best positioned to adapt. For Canadians, Bill C-27 is a reminder that digital rights are a political choice, and one worth paying attention to.