Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy and data protection landscape is undergoing its most significant transformation in more than two decades. Bill C-27, the Digital Charter Implementation Act, 2022, proposes to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with a modernized framework built for the realities of artificial intelligence, cloud computing, and large-scale data processing. For businesses operating in Canada and for everyday Canadians, understanding what this legislation does—and what it means in practice—is essential.

This guide breaks down the three statutes bundled within Bill C-27, the rights and obligations they create, how enforcement will work, and the practical steps organizations should start taking now.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is a federal Canadian bill introduced by the Minister of Innovation, Science and Industry. It modernizes Canada's private-sector privacy regime and, for the first time, introduces a dedicated statute to govern artificial intelligence systems used in commerce.

The bill is composed of three distinct pieces of legislation:

Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and sets the new rules for how private-sector organizations collect, use, and disclose personal information.
Personal Information and Data Protection Tribunal Act (PIDPTA) — creates an administrative tribunal to hear appeals of decisions made by the Privacy Commissioner and impose monetary penalties.
Artificial Intelligence and Data Act (AIDA) — Canada's first federal law specifically regulating "high-impact" AI systems in the private sector.

Together, these three acts form the backbone of what the federal government calls Canada's Digital Charter — a set of ten principles aimed at building trust in the digital economy, including universal access, safety, data portability, transparency, and strong enforcement.

Why Canada Needed New Privacy Legislation

PIPEDA was enacted in 2000, long before smartphones, social media, generative AI, or ubiquitous cloud storage. It was built on consent and reasonableness, but critics have long argued it lacks real teeth. The Privacy Commissioner of Canada can investigate complaints and issue recommendations, but has no power to levy fines directly.

Meanwhile, the European Union's GDPR raised global expectations in 2018 with potential penalties of up to 4% of global turnover. Québec passed its own modernized Law 25, which came fully into force in 2024. Without a federal update, Canada risked losing its "adequacy" status with the EU — a designation that permits the free flow of personal data between jurisdictions and is critical for Canadian exporters of digital services.

Bill C-27 is Ottawa's answer: a framework designed to restore international alignment, give regulators real enforcement power, and address emerging risks from AI.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the centrepiece of Bill C-27. It applies to every private-sector organization that collects, uses, or discloses personal information in the course of commercial activities across provincial or national borders — essentially the same scope as PIPEDA, but with substantially stronger obligations.

New and Enhanced Individual Rights

Right to disposal (deletion): Individuals can request that organizations dispose of their personal information, subject to limited exceptions.
Data mobility: Individuals can request the transfer of their personal information from one organization to another, within a prescribed framework.
Algorithmic transparency: On request, organizations must explain predictions, recommendations, or decisions made about individuals by automated decision systems.
Enhanced consent requirements: Consent must be obtained in plain language and must specify the purposes, type of information, foreseeable consequences, and third parties involved.
Protections for minors: The personal information of minors is explicitly treated as "sensitive" by default, triggering heightened safeguards.

New Business Obligations

Implement a written privacy management program proportionate to the organization's size and the sensitivity of information handled.
Designate an individual accountable for privacy compliance.
Conduct and document privacy impact assessments for activities that could pose a high risk.
Notify the Privacy Commissioner and affected individuals of breaches of security safeguards that create a real risk of significant harm.
Maintain records of data flows, retention schedules, and de-identification practices.

De-identification and Anonymization

The CPPA formally defines two concepts that PIPEDA did not clearly address:

De-identified information — information modified so an individual cannot be directly identified, though re-identification remains theoretically possible. The CPPA still applies.
Anonymized information — information irreversibly and permanently modified so no individual can be identified. The CPPA does not apply.

This distinction is crucial for analytics, research, and AI training workflows.

Penalties and Enforcement Under Bill C-27

One of the biggest shifts under Bill C-27 is the introduction of real financial consequences for non-compliance. The current PIPEDA regime caps fines at $100,000 for narrow offences. Under the CPPA, the stakes rise dramatically.

Violation Type	Maximum Penalty
Administrative monetary penalty (serious contraventions)	Greater of $10 million CAD or 3% of global gross revenue
Criminal offences (e.g., knowingly obstructing an investigation, retaliating against whistleblowers)	Greater of $25 million CAD or 5% of global gross revenue
Private right of action	Individuals may sue for damages after a finding of contravention

Enforcement is split between two bodies: the Office of the Privacy Commissioner of Canada (OPC), which investigates and makes findings, and the new Personal Information and Data Protection Tribunal, which hears appeals and imposes penalties. This two-tier structure is modeled loosely on Canada's competition law framework.

The Artificial Intelligence and Data Act (AIDA)

AIDA is the first federal attempt in Canada to regulate AI systems directly. It focuses on "high-impact" systems — a term that will be fleshed out through regulations but is expected to include AI used in employment decisions, healthcare, biometric identification, content moderation at scale, essential services, and law enforcement contexts.

Core AIDA Obligations

Risk assessment: Determine whether an AI system qualifies as high-impact.
Mitigation measures: Establish measures to identify, assess, and mitigate risks of harm and biased output.
Monitoring: Monitor compliance with mitigation measures and the effectiveness of those measures over time.
Transparency: Publish plain-language descriptions of high-impact systems, including their intended use and the types of content they generate.
Record-keeping: Maintain records that demonstrate compliance.
Incident reporting: Notify the Minister if use of a system results, or is likely to result, in material harm.

AIDA Penalties

AIDA creates both regulatory and criminal offences. Administrative penalties can reach the greater of $10 million or 3% of global revenue, while criminal offences for conduct such as making an AI system available knowing it is likely to cause serious harm can reach up to $25 million or 5% of global revenue.

How Bill C-27 Compares to GDPR and Québec's Law 25

Businesses that already comply with the GDPR or Québec's Law 25 will find much of Bill C-27 familiar, but important differences remain.

Feature	Bill C-27 (CPPA)	Québec Law 25	EU GDPR
Max admin fine	3% of global revenue or $10M	4% of global turnover or $25M CAD	4% of global turnover or €20M
Right to deletion	Yes (right to disposal)	Yes	Yes
Data portability	Yes (subject to regulations)	Yes (in force 2024)	Yes
Automated decision explanation	Yes, on request	Yes, on request	Yes (Art. 22)
Dedicated AI statute	Yes (AIDA)	No (covered by Law 25 ADS rules)	Separate EU AI Act
Private right of action	Yes	Yes	Yes

Pros and Cons of Bill C-27

Pros

Brings Canadian privacy law closer to international standards, helping preserve EU adequacy.
Introduces meaningful penalties that incentivize genuine compliance.
Grants Canadians stronger, modern rights over their personal data.
Provides Canada's first federal framework for AI accountability.
Clarifies rules around de-identified and anonymized information, enabling responsible innovation.

Cons

AIDA has been widely criticized for leaving too many key definitions to future regulations.
The two-tier OPC/Tribunal structure may slow enforcement compared to a single-regulator model.
Small and mid-sized businesses face new compliance costs and documentation burdens.
Some rights (e.g., data mobility) depend on frameworks that have yet to be defined.
Potential overlap and tension with Québec's Law 25 and provincial statutes in Alberta and British Columbia.

What Businesses Should Do Now

Even though Bill C-27 continues to work its way through Parliament and transition periods will apply once passed, waiting is not a strategy. Organizations that start preparing now will be far better positioned when the law takes effect.

Map your data. Document what personal information you collect, where it is stored, who it is shared with, and how long you retain it.
Review consent flows. Rewrite privacy notices and consent forms in plain language, specifying purposes and third parties.
Build or update a privacy management program. Appoint a privacy officer, create policies, and train staff.
Inventory AI systems. Identify any automated decision systems and begin assessing whether they would qualify as "high-impact" under AIDA.
Tighten vendor contracts. Ensure processors and service providers offer equivalent protection and breach notification commitments.
Audit your public-facing links and tracking. Marketing links, pixels, and analytics parameters can leak personal data. Using a privacy-respecting link management platform like Lunyb helps you keep tracking proportionate, transparent, and compliant with the CPPA's data-minimization expectations.
Prepare for breach reporting. Build a tested incident response plan with clear notification timelines.

How Bill C-27 Affects Everyday Canadians

For individuals, Bill C-27 translates into practical improvements in day-to-day digital life:

You will be able to ask companies to delete your account and associated data in most circumstances.
You will be able to request a plain-language explanation of why an algorithm denied you a loan, flagged your account, or recommended a particular outcome.
Children's data will receive stronger default protections.
Where enforcement finds a contravention, you will have a clearer path to sue for damages.
You can expect more transparency about which companies are using AI in consequential decisions about you.

None of this removes the need for personal digital hygiene. Using strong unique passwords, enabling multi-factor authentication, keeping software updated, choosing privacy-respecting browsers and encrypted DNS, and being thoughtful about which services receive your data all remain essential — regardless of what the law requires.

The Road Ahead

Bill C-27 has moved through multiple parliamentary stages and committee study, and amendments have been proposed, particularly to AIDA. Final passage, royal assent, and the subsequent regulations will determine the exact shape of the regime. Historically, Canadian privacy reform has taken longer than expected, but the direction of travel is clear: stronger rights for individuals, higher stakes for organizations, and dedicated oversight of AI.

Organizations that treat compliance as a competitive advantage — building trust through transparency, data minimization, and secure-by-design practices — will be the ones that thrive under the new rules.

Frequently Asked Questions

When will Bill C-27 come into force?

Bill C-27 has not yet received royal assent as of its most recent parliamentary stages. Once passed, the government has indicated that most provisions will come into force following a transition period — likely 12 to 24 months — to give organizations time to implement compliance programs. AIDA is expected to have its own, longer phase-in.

Does Bill C-27 replace PIPEDA entirely?

It replaces Part 1 of PIPEDA, which contains the private-sector privacy rules. The electronic documents provisions of PIPEDA (Parts 2 to 5) remain in force. Provincial private-sector privacy laws in Québec, Alberta, and British Columbia continue to apply where they have been deemed substantially similar.

How does Bill C-27 define a "high-impact" AI system?

AIDA itself does not provide an exhaustive definition — the specific categories will be set out in regulations. However, government guidance has pointed to systems used in employment, provision of essential services, biometric identification, healthcare, content moderation at scale, and law enforcement as likely candidates.

Can individuals sue companies directly under the CPPA?

Yes. The CPPA includes a private right of action that allows individuals to sue for damages after the Privacy Commissioner (or Tribunal on appeal) has made a finding that an organization contravened the Act. This is in addition to administrative penalties.

What should small businesses do to prepare?

Start with the basics: inventory the personal data you hold, document your purposes, update your privacy policy in plain language, appoint someone accountable for privacy, and establish a breach response procedure. Privacy management obligations must be "proportionate" to the size and sensitivity of your activities, so small businesses are not expected to match the programs of large enterprises — but they are expected to have a program.