Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is undergoing its most significant transformation in more than two decades. Bill C-27, formally known as the Digital Charter Implementation Act, promises to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modernized framework fit for an economy driven by data, artificial intelligence, and cross-border digital services. Whether you run a small e-commerce store in Vancouver or a national SaaS platform headquartered in Toronto, this legislation will shape how you collect, use, and protect personal information for years to come.

This guide breaks down what Bill C-27 actually does, who it applies to, what the penalties look like, and the practical steps Canadian organisations should take now to prepare.

What Is Bill C-27?

Bill C-27, the Digital Charter Implementation Act, 2022, is Canadian federal legislation introduced to overhaul the country's private-sector privacy law and introduce the nation's first dedicated rules for artificial intelligence systems. It bundles three distinct statutes into a single bill, each addressing a different pillar of digital trust.

The three components are:

Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and modernises how private organisations handle personal data.
Personal Information and Data Protection Tribunal Act (PIDPTA) — creates a new administrative tribunal to review decisions made by the Privacy Commissioner and impose penalties.
Artificial Intelligence and Data Act (AIDA) — establishes Canada's first federal framework governing the design, deployment, and use of high-impact AI systems.

Together, these three pieces aim to align Canada more closely with international privacy standards such as the EU's GDPR, while adding guardrails for emerging technologies that PIPEDA was never designed to address.

Why Is Canada Replacing PIPEDA?

PIPEDA has been in force since 2000. When it was drafted, cloud computing, mobile apps, social media, generative AI, and large-scale data brokerages barely existed. Over the years, the Office of the Privacy Commissioner of Canada (OPC), industry groups, and civil liberties advocates have all argued that PIPEDA lacks the enforcement power and clarity needed for a modern digital economy.

Three key weaknesses pushed the government toward reform:

Weak enforcement. The Privacy Commissioner could investigate and recommend, but not fine. Companies faced little financial consequence for violations.
Vague consent rules. PIPEDA's standards for meaningful consent struggled against modern practices like behavioural advertising, data brokering, and automated decision-making.
No AI framework. Nothing in federal law specifically addressed algorithmic bias, automated decisions affecting individuals, or high-impact AI systems.

Bill C-27 is Canada's answer to these gaps.

The Consumer Privacy Protection Act (CPPA)

The CPPA is the centrepiece of Bill C-27. It governs how private-sector organisations across Canada collect, use, and disclose personal information in the course of commercial activity. If PIPEDA was a polite request, the CPPA is a legally enforceable rulebook.

Key Changes Under the CPPA

Plain-language consent. Consent requests must be clear, specific, and understandable to the average person — no more burying permissions in 40-page terms of service.
Right to data mobility. Individuals can request that their personal information be transferred from one organisation to another where a data mobility framework exists.
Right to deletion (disposal). Canadians can ask organisations to delete their personal information, subject to limited exceptions.
Algorithmic transparency. Organisations using automated decision systems must explain, on request, how a prediction, recommendation, or decision was made and what personal data was used.
Enhanced protections for minors. Information about children is treated as sensitive by default, triggering stricter handling obligations.
Privacy management programs. Every organisation must have a documented program covering policies, training, complaint handling, and risk assessments.

De-identified vs. Anonymised Data

The CPPA draws an important distinction. De-identified data has had direct identifiers removed but could still be re-linked to a person; it remains personal information with reduced obligations. Anonymised data has been irreversibly stripped so that no individual can be identified, and it falls outside the Act. Getting this distinction wrong is one of the easiest ways to end up in trouble.

The Artificial Intelligence and Data Act (AIDA)

AIDA is the most novel — and most debated — part of Bill C-27. It would be Canada's first federal law targeting AI systems directly, focusing specifically on "high-impact" systems that pose a meaningful risk of harm or biased output.

Core AIDA Obligations

Risk assessment. Organisations must assess whether their AI qualifies as a high-impact system under forthcoming regulations.
Mitigation measures. If it does, they must implement measures to identify, assess, and reduce risks of harm or biased output.
Monitoring. Ongoing monitoring of mitigation effectiveness is mandatory, not optional.
Transparency. Public-facing descriptions of how high-impact systems are used must be published in plain language.
Record-keeping. Detailed records of data provenance, testing, and risk management must be retained.

AIDA also creates new criminal offences for knowingly using unlawfully obtained personal data to train AI systems or deploying AI with the intent to cause serious harm or economic loss.

Penalties: The Real Teeth of Bill C-27

One of the biggest shifts from PIPEDA is the introduction of substantial financial penalties. Canadian regulators will finally have real enforcement power.

Violation Type	Maximum Penalty
Administrative monetary penalties (CPPA)	Up to the greater of $10 million CAD or 3% of global gross revenue
Serious offences (CPPA, prosecuted)	Up to the greater of $25 million CAD or 5% of global gross revenue
AIDA regulatory violations	Up to the greater of $10 million CAD or 3% of global gross revenue
AIDA criminal offences (e.g., reckless harm)	Up to the greater of $25 million CAD or 5% of global gross revenue

These numbers put Canada roughly on par with the GDPR in terms of financial exposure — a dramatic departure from PIPEDA's effectively zero-dollar fines.

Who Does Bill C-27 Apply To?

The CPPA applies to every private-sector organisation that collects, uses, or discloses personal information in the course of commercial activity across Canada. That includes:

Retailers and e-commerce operators
SaaS companies and app developers
Financial institutions and insurers
Healthcare providers operating commercially
Marketing agencies and ad-tech vendors
Foreign businesses offering goods or services to Canadians

Provinces with their own substantially similar legislation — Quebec (Law 25), British Columbia (PIPA), and Alberta (PIPA) — will continue to govern intra-provincial activity, but federal rules apply to cross-border and interprovincial flows.

AIDA applies specifically to organisations designing, developing, or making available high-impact AI systems in the course of international or interprovincial trade.

CPPA vs. PIPEDA: A Quick Comparison

Feature	PIPEDA (current)	CPPA (under Bill C-27)
Fines	None directly	Up to 5% of global revenue
Right to deletion	Limited	Explicit disposal right
Data mobility	Not included	Framework-based right
Minors' data	No special category	Treated as sensitive
Automated decisions	Not addressed	Explanation on request
AI governance	None	AIDA framework
Tribunal appeals	Federal Court	New dedicated tribunal

How to Prepare Your Business for Bill C-27

Even though Bill C-27 is still progressing through Parliament and will have a transition period before full enforcement, waiting is not a strategy. Companies that prepare early will absorb the change far more smoothly — and build customer trust in the process.

1. Map Your Data

Create or update a complete inventory of what personal information you collect, where it is stored, who has access, how long you keep it, and which third parties receive it. You cannot protect what you cannot see.

2. Rewrite Consent Flows

Review every point where you ask Canadians for consent — signup forms, cookie banners, mobile app permissions, loyalty programs. Rewrite them in plain language a 14-year-old could understand. Separate essential uses from optional ones.

3. Build a Privacy Management Program

Document your policies, incident response procedures, employee training, vendor assessments, and complaint handling. The CPPA explicitly requires this program and the Privacy Commissioner can demand to see it.

4. Review Marketing and Link Tracking Practices

Marketing teams often rely on tracking parameters, pixel tags, and third-party analytics that quietly collect personal information. Audit these flows. If you shorten and share links for campaigns, choose a provider that gives you clean analytics without over-collecting user data — a privacy-respecting URL shortener like Lunyb can simplify compliance by keeping tracking proportionate. For a broader look at options, see our 2026 buyer's guide to URL shorteners.

5. Classify Your AI Systems

If you use AI anywhere in your operations — hiring, credit decisions, content moderation, customer support routing — begin assessing whether any of them might qualify as "high-impact" under AIDA. Document design choices, training data sources, and testing results now.

6. Appoint a Privacy Lead

Someone must be formally accountable for privacy inside your organisation. For smaller companies this may be a dual-hatted role, but it needs to be named, trained, and empowered.

7. Update Vendor Contracts

Any service provider handling personal information on your behalf must offer protection comparable to your own obligations. Refresh data-processing clauses, audit rights, and breach-notification timelines.

What About Quebec's Law 25?

Quebec's Law 25 (formerly Bill 64) has already brought GDPR-style rules to the province, phased in between 2022 and 2024. Organisations that have done the work for Law 25 will find the CPPA familiar — the two share concepts like privacy impact assessments, data portability, and significant fines. If you're compliant in Quebec, you're a long way toward federal readiness.

Common Misconceptions About Bill C-27

"It only affects big tech." False. The CPPA applies to organisations of all sizes. Small businesses get some scaled obligations but are not exempt.
"Anonymised data lets us do anything." Only true if the data is genuinely, irreversibly anonymised — a very high bar.
"AIDA only applies to AI companies." No. It applies to anyone deploying high-impact AI systems, including businesses using third-party tools.
"We can wait until it passes." Risky. Enforcement will arrive with a transition window, but engineering, legal, and training changes take many months.

The Bigger Picture: Canada's Digital Trust Strategy

Bill C-27 is more than a privacy update. It's part of a broader federal push to position Canada as a trusted jurisdiction for digital commerce, AI investment, and cross-border data flows. Alignment with the GDPR matters commercially: adequacy decisions, trade agreements, and multinational contracts increasingly hinge on whether a country's laws measure up. For Canadian businesses, that alignment is an opportunity, not just a burden.

Frequently Asked Questions

When will Bill C-27 come into force?

As of 2026, Bill C-27 has moved through parliamentary review but final passage and in-force dates depend on ongoing legislative progress. Once enacted, the CPPA and AIDA are expected to have transition periods, with AIDA's substantive obligations likely phased in over two or more years to allow for regulations to be drafted.

Does Bill C-27 replace provincial privacy laws?

No. Provincial laws deemed substantially similar — such as Quebec's Law 25, BC's PIPA, and Alberta's PIPA — continue to govern activity within those provinces. The CPPA applies to federally regulated organisations and to interprovincial and international data flows.

What qualifies as a "high-impact" AI system under AIDA?

The precise definition will be set in regulations, but the government has signalled that systems used in employment, service delivery, biometric identification, content moderation at scale, health, and decisions significantly affecting individuals' rights or economic interests are likely to be included.

How large can the fines actually get?

For the most serious offences under both the CPPA and AIDA, penalties can reach the greater of $25 million CAD or 5% of global gross revenue. For a mid-sized multinational, that can easily exceed PIPEDA-era enforcement by orders of magnitude.

What should a small Canadian business do first?

Start with three low-cost actions: inventory the personal data you hold, simplify your privacy notice into plain language, and name someone internally as the privacy lead. These three steps alone will put you ahead of most small organisations and lay the foundation for everything else the CPPA requires.

Final Thoughts

Bill C-27 marks a generational shift in Canadian digital regulation. It gives Canadians stronger rights, gives regulators real enforcement power, and finally brings AI governance into federal law. For businesses, the message is clear: treat privacy and algorithmic accountability as core operational disciplines, not legal afterthoughts. Companies that invest now in cleaner data practices, honest consent, and well-governed AI will not only avoid penalties — they'll earn the kind of customer trust that becomes a durable competitive advantage.