Bill C-27 Digital Charter: What You Need to Know in 2026

Canada is in the middle of its most significant privacy and data governance overhaul in more than two decades. Bill C-27, the Digital Charter Implementation Act, proposes to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modern framework built for an AI-driven economy. For businesses, developers, and everyday Canadians, understanding this legislation is no longer optional — it will shape how personal data is collected, how automated decisions are made, and how violations are penalized.

This guide breaks down what Bill C-27 actually contains, who it affects, how it compares to existing law, and what organizations should be doing right now to prepare.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is a federal Canadian bill introduced by the Minister of Innovation, Science and Industry. It bundles three separate but related pieces of legislation into one package:

The Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and governs how private-sector organizations handle personal information.
The Personal Information and Data Protection Tribunal Act — creates a new administrative tribunal to review decisions and impose penalties.
The Artificial Intelligence and Data Act (AIDA) — Canada's first dedicated federal law targeting high-impact AI systems.

Together, these three acts are intended to implement the Government of Canada's Digital Charter — a 10-principle framework announced in 2019 that promises Canadians greater control over their data, transparency from businesses, and meaningful enforcement when things go wrong.

Why PIPEDA Needed a Replacement

PIPEDA was enacted in 2000, long before smartphones, social media platforms, generative AI, or large-scale data brokerage existed in their current form. Its maximum penalties were widely considered too low to deter misconduct by major platforms, and the Office of the Privacy Commissioner of Canada (OPC) had limited power to issue binding orders. The European Union's GDPR, Quebec's Law 25, and California's CPRA have all raised the global bar, leaving Canada's federal framework looking out of date.

The Consumer Privacy Protection Act (CPPA)

The CPPA is the centerpiece of Bill C-27. It modernizes consent rules, expands individual rights, and dramatically increases penalties for non-compliance.

Key Rights for Individuals

Right to deletion (disposal): Individuals can request that organizations delete their personal information, subject to limited exceptions.
Data mobility: Canadians can request that their data be transferred between designated organizations under a framework still to be defined by regulation.
Algorithmic transparency: When an organization uses an automated decision system to make a prediction, recommendation, or decision that could significantly impact an individual, it must provide a plain-language explanation on request.
Enhanced consent requirements: Consent must be obtained in plain language at or before the time personal information is collected, and must specify the purpose.
Stronger protections for minors: Information of minors is treated as sensitive by default, triggering heightened obligations.

Obligations for Organizations

Implement a documented privacy management program proportionate to the volume and sensitivity of data handled.
Conduct and document assessments before activities that could create a high risk of harm.
Report significant breaches of security safeguards to the Privacy Commissioner and affected individuals.
Enter into enforceable contracts with service providers that handle personal information on the organization's behalf.
Designate an individual responsible for privacy compliance (often called a Chief Privacy Officer or Privacy Lead).

Penalties Under the CPPA

Penalties under the CPPA are among the stiffest in Canadian regulatory history:

Violation Type	Maximum Administrative Penalty	Maximum Fine on Prosecution
Serious contraventions (e.g. consent violations)	3% of global revenue or CAD $10 million (whichever is higher)	5% of global revenue or CAD $25 million (whichever is higher)
Offences (e.g. obstructing investigations, retaliating against whistleblowers)	—	5% of global revenue or CAD $25 million (whichever is higher)

The Personal Information and Data Protection Tribunal

The second component of Bill C-27 creates a new quasi-judicial body — the Personal Information and Data Protection Tribunal. Its role is to hear appeals of Privacy Commissioner decisions and to impose administrative monetary penalties.

How Enforcement Will Work

An individual files a complaint, or the Commissioner initiates an investigation.
The Commissioner investigates and may issue findings or compliance orders.
If a penalty is recommended, the matter proceeds to the Tribunal.
The Tribunal holds hearings and issues binding decisions, including penalties.
Tribunal decisions can be appealed to the Federal Court of Appeal on questions of law.

This two-step model is designed to separate investigation from adjudication, addressing a long-standing criticism that the OPC acted as both investigator and decision-maker. Critics, however, argue that adding a tribunal may slow enforcement compared to GDPR's direct-penalty model.

The Artificial Intelligence and Data Act (AIDA)

AIDA is the most novel — and most controversial — part of Bill C-27. It represents Canada's first attempt to regulate artificial intelligence at the federal level, focusing on "high-impact" AI systems.

What AIDA Would Require

Identify whether an AI system qualifies as "high-impact" based on criteria set out in regulations.
Establish measures to identify, assess, and mitigate risks of harm or biased output.
Monitor compliance with those mitigation measures on an ongoing basis.
Publish plain-language descriptions of high-impact systems, including their intended use and limitations.
Keep records demonstrating compliance and notify the Minister of material harm.

Criminal Provisions

AIDA also introduces criminal offences for knowingly or recklessly making an AI system available where its use causes serious harm, or for using personal information unlawfully obtained to design, develop, or use an AI system. These are novel in Canadian law and have attracted significant debate.

Criticism and Amendments

AIDA has been criticized for leaving too much to future regulations, for an unclear definition of "high-impact," and for insufficient consultation with civil society and researchers. The government has proposed amendments aligning AIDA more closely with the EU AI Act, including defined categories of high-impact systems such as employment screening, biometric identification, content moderation at scale, healthcare, and law enforcement applications.

How Bill C-27 Compares to Other Privacy Laws

Feature	Bill C-27 (CPPA)	EU GDPR	Quebec Law 25	PIPEDA (current)
Right to deletion	Yes	Yes	Yes	Limited
Data portability	Yes (framework TBD)	Yes	Yes	No
Algorithmic transparency	Yes	Yes (Art. 22)	Yes	No
Max penalty	5% global revenue / $25M CAD	4% global revenue / €20M	4% global revenue / $25M CAD	$100,000 CAD
Dedicated AI law	Yes (AIDA)	Separate (EU AI Act)	No	No
Private right of action	Yes (after Commissioner finding)	Yes	Yes	Limited

Who Does Bill C-27 Apply To?

The CPPA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities, as well as to federally regulated employers handling employee data. It covers Canadian companies and foreign organizations that handle the personal information of Canadians — meaning global SaaS platforms, e-commerce sites, and marketing services all fall within its reach.

AIDA applies to persons responsible for designing, developing, making available, or managing the operation of AI systems in the course of international or interprovincial trade and commerce. Government institutions are generally excluded and will be governed by separate instruments.

Small Business Considerations

While the CPPA does not exempt small businesses outright, the law allows the scope of a privacy management program to be proportionate to the organization's size and the sensitivity of data handled. Startups and SMBs should still expect to implement baseline documentation, consent flows, and breach-response processes.

Practical Steps to Prepare for Bill C-27

Even though the bill is still progressing through Parliament, prudent organizations are already building toward compliance. Many of the required practices overlap with GDPR and Quebec Law 25, so the lift is often smaller than it appears.

Map your data. Document what personal information you collect, where it's stored, who it's shared with, and why.
Review consent flows. Replace long legalistic policies with plain-language notices at the point of collection.
Build a deletion workflow. Create a documented process for honoring disposal requests across all systems, including backups and third-party processors.
Audit automated decision systems. Identify any models that produce significant decisions about people and prepare plain-language explanations.
Update vendor contracts. Ensure processors have equivalent protection obligations and breach-notification clauses.
Train staff. Privacy obligations will touch marketing, engineering, HR, and customer support teams.
Minimize what you collect. The simplest compliance strategy is to collect less data in the first place.

Minimizing Data at the Link Level

One often-overlooked data source is the humble shortened URL. Many link shorteners harvest extensive click telemetry — IP addresses, device fingerprints, approximate geolocation, and referrer chains — which may constitute personal information under the CPPA. Choosing a privacy-respecting link tool like Lunyb helps marketing and product teams keep tracking footprints proportionate and defensible. For a broader comparison of options, see our 2026 buyer's guide to URL shorteners.

What Happens Next?

Bill C-27 has been studied extensively by the House of Commons Standing Committee on Industry and Technology. The government has signaled openness to significant amendments, particularly to AIDA. If passed, most provisions would come into force on a date fixed by order of the Governor in Council, with organizations typically given a transition period of 12 to 24 months.

It's worth noting that Quebec's Law 25 is already fully in force, so organizations operating in Quebec cannot wait for federal legislation to begin modernizing their privacy programs. Harmonizing early with the stricter of the two regimes is generally the most efficient path.

Impact on Consumers

For Canadians, Bill C-27 promises more meaningful control over personal data: clearer consent, the ability to request deletion, explanations of algorithmic decisions, and real penalties when organizations misuse information. The practical experience will depend heavily on how aggressively the Privacy Commissioner and the new Tribunal exercise their powers.

Consumers can also take their own steps: review which services hold their data, use privacy-respecting browsers and encrypted DNS resolvers, limit app permissions, and favor tools and platforms that publish clear, minimal data-collection practices.

FAQ

Is Bill C-27 the same as PIPEDA?

No. Bill C-27 would replace the private-sector portion of PIPEDA with the new Consumer Privacy Protection Act, add a dedicated Tribunal, and introduce Canada's first federal AI law (AIDA). Until Bill C-27 is passed and brought into force, PIPEDA remains the operative federal privacy law for the private sector.

When will Bill C-27 come into force?

As of 2026, Bill C-27 is still progressing through Parliament. Even once passed, most provisions will come into force on a date set by the Governor in Council, typically after a transition period. Organizations should assume effective dates in the 12–24 month range following royal assent.

Does Bill C-27 apply to small businesses?

Yes. There is no blanket exemption for small businesses, but the CPPA allows privacy management programs to scale with the organization's size and the sensitivity of data handled. Even small businesses must still obtain valid consent, respond to deletion requests, and report significant breaches.

How is AIDA different from the EU AI Act?

Both laws regulate high-impact AI systems, but AIDA is narrower in scope, leaves many definitions to future regulations, and focuses on international and interprovincial trade. The EU AI Act defines specific risk categories (unacceptable, high, limited, minimal) in the statute itself and applies to a broader range of actors. Proposed amendments to AIDA aim to narrow this gap.

What are the penalties for non-compliance?

The CPPA allows administrative monetary penalties of up to 3% of global revenue or CAD $10 million, and fines on prosecution of up to 5% of global revenue or CAD $25 million — whichever is higher. These are among the most severe privacy penalties in Canadian history and are roughly comparable to the EU GDPR.