Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's data protection landscape is undergoing its most significant transformation in more than two decades. Bill C-27, formally known as the Digital Charter Implementation Act, 2022, proposes to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modernized framework built for an AI-driven economy. For businesses operating in Canada and for Canadians who care about how their personal data is handled, understanding this legislation is no longer optional.

What Is Bill C-27?

Bill C-27 is a federal Canadian legislative package introduced in June 2022 that bundles three major pieces of law into one bill: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). Together, they form the backbone of Canada's updated Digital Charter.

The bill is designed to strengthen privacy rights for Canadians, impose stricter accountability on organizations that collect and process personal data, and create Canada's first dedicated AI governance regime. If passed in its current form, it will give the federal Privacy Commissioner significantly expanded powers and introduce administrative penalties that rank among the toughest in the world.

Why Replace PIPEDA?

PIPEDA was enacted in 2000, long before smartphones, cloud computing, generative AI, or ubiquitous data brokers existed. Over the years, the European Union's GDPR, California's CCPA, Quebec's Law 25, and dozens of other frameworks have raised the bar. Canada risked losing its "adequacy" status with the EU, which allows personal data to flow freely between the two jurisdictions. Bill C-27 is Ottawa's answer to that pressure.

The Three Pillars of Bill C-27

1. The Consumer Privacy Protection Act (CPPA)

The CPPA replaces Part 1 of PIPEDA and governs how private-sector organizations collect, use, and disclose personal information. Key features include:

• Explicit, plain-language consent for most data processing activities.
• The right to data mobility, allowing individuals to transfer their personal information between organizations.
• The right to deletion (often called the "right to be forgotten") where data is no longer needed.
• Algorithmic transparency, requiring organizations to explain automated decisions that significantly affect individuals.
• Enhanced protections for minors, treating children's data as inherently sensitive.

2. The Personal Information and Data Protection Tribunal Act

This creates a new administrative body, the Personal Information and Data Protection Tribunal, to review decisions made by the Privacy Commissioner and impose monetary penalties. The tribunal is designed to add a layer of specialized expertise and procedural fairness before fines reach the courts.

3. The Artificial Intelligence and Data Act (AIDA)

AIDA is Canada's first federal attempt to regulate AI systems. It focuses on "high-impact" AI applications, requires risk assessments, mandates bias mitigation, and creates offences for reckless or malicious use of AI that causes harm. A new AI and Data Commissioner would oversee compliance.

Who Does Bill C-27 Apply To?

The CPPA applies to every private-sector organization that collects, uses, or discloses personal information in the course of commercial activity across provincial or national borders. This includes:

1. Canadian businesses of any size handling customer data.
2. Foreign companies offering goods or services to Canadians.
3. Federally regulated industries such as banking, telecommunications, and transportation.
4. Charities and non-profits engaged in commercial activity.

Quebec businesses already governed by Law 25 will still need to comply with the CPPA when operating interprovincially. Alberta and British Columbia have their own substantially similar private-sector laws, but Bill C-27 will raise the floor nationwide.

Key Rights Granted to Canadians

Right to Know

Canadians can request a clear explanation of what personal information an organization holds, where it came from, and how it is used.

Right to Deletion

Individuals can ask organizations to delete personal information that is no longer necessary for the purpose it was collected, subject to legal retention requirements.

Right to Data Portability

Users can request their data in a structured, commonly used format and have it transferred to another organization, provided a data mobility framework exists between the two.

Right to an Explanation of Automated Decisions

When an algorithm makes a significant decision about a person, such as denying credit or filtering a job application, the person has a right to understand the reasoning and the data used.

Enhanced Protections for Minors

All information about minors is deemed sensitive by default, triggering stricter consent, retention, and purpose-limitation rules.

Penalties: Why Businesses Are Paying Attention

The financial stakes under Bill C-27 are substantial. The bill introduces a two-tier penalty structure that eclipses PIPEDA's largely toothless enforcement.

Violation Type	Maximum Administrative Penalty	Maximum Fine on Prosecution
Non-compliance with CPPA obligations	3% of global revenue or CA$10 million	5% of global revenue or CA$25 million
Serious offences (e.g., knowingly using de-identified data to re-identify individuals)	N/A	5% of global revenue or CA$25 million
AIDA violations (high-impact AI systems)	3% of global revenue or CA$10 million	5% of global revenue or CA$25 million

These numbers put Canada roughly in line with the EU's GDPR, which caps fines at 4% of global turnover. For multinational companies, the exposure is significant.

How Bill C-27 Compares to GDPR and Quebec Law 25

Feature	Bill C-27 (CPPA)	GDPR (EU)	Quebec Law 25
Right to deletion	Yes, with exceptions	Yes, broad	Yes
Data portability	Yes, framework-dependent	Yes	In force 2024
Automated decision explanation	Yes	Yes	Yes
Dedicated AI law	Yes (AIDA)	Separate EU AI Act	No
Max penalty	5% global revenue	4% global revenue	4% global revenue
Privacy officer required	Yes	Yes (DPO for some)	Yes
Breach notification	Mandatory	Mandatory (72 hours)	Mandatory

What Businesses Should Do Now

Even though Bill C-27 is still progressing through Parliament and may be amended further, prudent organizations are preparing now. Here is a practical compliance roadmap:

1. Map your data. Document what personal information you collect, where it is stored, who has access, and why.
2. Review consent flows. Replace vague terms-of-service clauses with plain-language, purpose-specific consent.
3. Appoint a privacy officer. The CPPA requires every organization to designate someone accountable for compliance.
4. Build a breach response plan. You will need to detect, assess, and report material breaches to the Privacy Commissioner and affected individuals.
5. Audit your AI systems. Identify any "high-impact" systems and begin risk assessments under AIDA.
6. Update vendor contracts. Ensure processors and sub-processors meet the same standards you do.
7. Train your staff. Privacy is a culture issue, not just a legal one.

The AI Dimension: Why AIDA Matters

AIDA is the most debated piece of Bill C-27. Critics argue it is too vague on what counts as a "high-impact" system and gives too much discretion to future regulations. Supporters say flexibility is essential given how quickly AI evolves.

Under AIDA, organizations developing or deploying high-impact AI must:

• Conduct and document impact assessments.
• Implement measures to identify, assess, and mitigate risks of harm or biased output.
• Monitor compliance and keep records.
• Publish plain-language descriptions of how the system is used.
• Notify the Minister of material harms.

Criminal offences apply where a person makes an AI system available knowing it is likely to cause serious harm, or where personal data obtained unlawfully is used to design an AI system.

Privacy in Practice: What Canadians Can Do Today

Legislation is only part of the equation. Individuals can take steps right now to reduce their digital footprint and better control what personal information they share online.

1. Review app permissions regularly on your phone and browser.
2. Use encrypted DNS and privacy-focused browsers to reduce tracking.
3. Enable two-factor authentication on every account that offers it.
4. Be careful what you click. Shortened links can hide suspicious destinations, so use trustworthy tools. Services like Lunyb provide clean, privacy-respecting link shortening with click analytics that do not require you to surrender personal details. For a deeper look, see our honest Lunyb review.
5. Request your data from major platforms to see what they hold about you.

If you're also evaluating link management tools for business use under tighter privacy rules, our 2026 URL shortener buyer's guide compares the major options and their data-handling practices.

Criticism and Controversy

Bill C-27 has not been without opposition. Civil liberties groups, academics, and the federal Privacy Commissioner himself have raised concerns, including:

• Privacy is still framed as a "commercial interest" rather than a fundamental human right.
• AIDA was tacked on late and received little consultation before introduction.
• The tribunal adds a layer that could slow enforcement rather than accelerate it.
• Legitimate interest exceptions could allow processing without meaningful consent.
• Children's protections, while improved, still fall short of what some jurisdictions require.

Amendments have been proposed through committee review, including language that would recognize privacy as a fundamental right. The final shape of the law will depend on the parliamentary process.

Timeline and Current Status

Bill C-27 was introduced in June 2022 and has moved slowly through the House of Commons Standing Committee on Industry and Technology. As of 2026, portions of the bill continue to face parliamentary scrutiny. Even once passed, organizations will likely have a transition period, estimated at one to two years, to come into full compliance. Quebec businesses already aligned with Law 25 will have a head start.

Frequently Asked Questions

Does Bill C-27 replace PIPEDA entirely?

It replaces Part 1 of PIPEDA, which governs private-sector data handling. Part 2 of PIPEDA, which deals with electronic documents and signatures, remains in force. The CPPA becomes the primary private-sector privacy law at the federal level.

Will my small business be affected?

Yes. The CPPA applies regardless of organization size if you collect personal information in a commercial context that crosses provincial or national borders. However, the law requires compliance measures to be proportionate to the volume and sensitivity of the data you handle, so a small shop will not face the same burden as a national bank.

How does Bill C-27 interact with Quebec's Law 25?

Quebec's Law 25 continues to apply within the province. The CPPA applies to interprovincial and international activity. Many businesses will need to meet both standards; fortunately, they overlap significantly. Where they differ, the stricter rule generally prevails for the data in question.

What counts as a "high-impact" AI system under AIDA?

The bill leaves the detailed definition to future regulation, but it is widely expected to include systems used in employment decisions, biometric identification, access to essential services, healthcare, and content moderation at scale. Businesses should assume that any AI meaningfully affecting individuals will be in scope.

When should I start preparing?

Now. Data mapping, consent redesign, and privacy officer appointments can take months. Organizations that wait until the law is proclaimed risk scrambling under a tight transition deadline, and good privacy hygiene pays dividends regardless of when C-27 ultimately takes effect.

Final Thoughts

Bill C-27 represents a long-overdue modernization of Canada's privacy framework. Whether or not it passes in its current form, the direction is clear: stronger rights for individuals, tougher penalties for organizations, and new rules of the road for artificial intelligence. Canadian businesses that treat compliance as a strategic opportunity rather than a checkbox exercise will be better positioned to earn customer trust and compete globally. For Canadians, the Digital Charter signals that privacy is finally being treated as the foundational issue it has always been in the digital age.