Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy landscape is undergoing its most significant transformation in over two decades. Bill C-27, the Digital Charter Implementation Act, proposes to replace parts of the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with modern rules covering consumer privacy, data protection tribunals, and — for the first time in Canada — artificial intelligence. If you run a business, build software, or simply care about your personal data, understanding Bill C-27 is no longer optional.

This guide breaks down what Bill C-27 actually says, how it compares to existing law, what penalties businesses face, and the practical steps organizations should take now to prepare.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is Canadian federal legislation that bundles three separate acts into one package. It was introduced in the House of Commons in June 2022 and, as of 2026, continues to work through the legislative process, with substantial committee amendments shaping its final form.

The bill is composed of three main pieces:

Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA with a modernized private-sector privacy law.
Personal Information and Data Protection Tribunal Act (PIDPTA) — creates an independent tribunal to review decisions of the Privacy Commissioner and impose administrative penalties.
Artificial Intelligence and Data Act (AIDA) — Canada's first federal statute specifically regulating AI systems.

Together, these three acts form the legal backbone of Canada's "Digital Charter," a 10-principle framework the federal government published to guide digital policy, covering trust, safety, control over data, and responsible innovation.

Why Bill C-27 Matters Now

PIPEDA was enacted in 2000. Since then, cloud computing, smartphones, social media, biometric identification, and generative AI have all emerged. Canada's existing law simply was not designed for this world. Meanwhile, the European Union's GDPR, Quebec's Law 25, and California's CPRA have raised the global baseline for privacy protection — leaving federal Canadian rules looking outdated and risking an "adequacy" downgrade from the EU, which would complicate trans-Atlantic data flows.

Bill C-27 is Ottawa's answer. It introduces meaningful fines, new individual rights, tighter rules around minors' data, and a governance framework for high-impact AI — bringing Canada closer to international norms.

The Consumer Privacy Protection Act (CPPA) Explained

The CPPA is the most immediately relevant piece of Bill C-27 for most organizations. It applies to any private-sector organization that collects, uses, or discloses personal information in the course of commercial activity.

Key New Rights for Individuals

Right to deletion (disposal): Individuals can request that organizations delete their personal information, subject to legal exceptions.
Right to data mobility: People can ask an organization to transfer their data to another organization within a designated framework.
Algorithmic transparency: Where an automated decision-making system is used to make a prediction, recommendation, or decision that could significantly impact an individual, the organization must, on request, provide an explanation.
Enhanced consent requirements: Consent must be sought in plain language, and organizations must identify the specific purpose for which data is collected.
Stronger protections for minors: The personal information of minors is deemed "sensitive by default," triggering higher protections and easier deletion rights.

New Obligations for Organizations

Implement a privacy management program proportional to the volume and sensitivity of data handled.
Maintain records of de-identification practices and ensure safeguards against re-identification.
Report breaches of security safeguards involving real risk of significant harm to both the Privacy Commissioner and affected individuals.
Appoint an individual accountable for CPPA compliance (functionally similar to a Data Protection Officer).
Make the privacy management program available to the Commissioner on request.

CPPA vs. PIPEDA vs. GDPR: A Comparison

How does the proposed CPPA stack up against the law it replaces and the global benchmark set by Europe's GDPR?

Feature	PIPEDA (current)	CPPA (Bill C-27)	GDPR (EU)
Maximum fine	CAD $100,000	Up to 5% of global revenue or CAD $25M	Up to 4% of global revenue or €20M
Right to deletion	Limited	Yes	Yes
Data portability	No	Yes (framework-based)	Yes
Algorithmic transparency	No	Yes (on request)	Yes (Art. 22)
Minors' data	No specific treatment	Sensitive by default	Enhanced protections
Breach notification	Yes	Yes (strengthened)	Yes (72 hours)
Enforcement body	Privacy Commissioner (advisory)	Commissioner + Tribunal (binding)	National DPAs

The Data Protection Tribunal

One of the most structurally important changes in Bill C-27 is the creation of the Personal Information and Data Protection Tribunal. Under PIPEDA, the Privacy Commissioner can investigate and make findings but cannot impose fines — enforcement ultimately requires going to Federal Court.

Under Bill C-27:

The Commissioner gains stronger order-making powers (e.g., ordering an organization to stop collecting data or to dispose of it).
The new Tribunal hears appeals of the Commissioner's decisions and determines administrative monetary penalties.
The Tribunal is composed of three to six members, at least three of whom must have expertise in information and privacy law.

The two-tier structure has been criticized by some privacy advocates who argue it adds delay, but it also provides procedural fairness and consistency that pure regulator-imposed fines may lack.

Penalties: How Serious Are They?

Bill C-27 introduces two tiers of financial consequences that represent a dramatic escalation over PIPEDA:

Administrative Monetary Penalties (AMPs)

Imposed by the Tribunal for certain contraventions, up to the greater of CAD $10 million or 3% of the organization's global gross revenues in the prior financial year.

Offence-Based Fines

For the most serious violations — such as knowingly using de-identified information to re-identify individuals, obstructing an investigation, or retaliating against whistleblowers — fines can reach the greater of CAD $25 million or 5% of global gross revenues.

For context, a mid-sized Canadian retailer with CAD $500 million in revenue could face up to CAD $25 million in administrative penalties alone — roughly 250 times the current PIPEDA maximum.

The Artificial Intelligence and Data Act (AIDA)

AIDA is the third and most debated piece of Bill C-27. It would establish Canada's first federal framework for regulating AI systems used in commerce.

What AIDA Would Require

Risk-based obligations focused on "high-impact" AI systems (a category to be defined by regulation but likely covering areas such as employment, healthcare, financial services, biometric identification, and content moderation).
Assessment and mitigation of risks of harm or biased output before and during deployment.
Transparency requirements, including public descriptions of high-impact systems.
Record-keeping on how systems were designed, trained, and tested.
Creation of an AI and Data Commissioner within the Ministry of Innovation, Science and Industry (ISED).

Pros and Cons of AIDA

Pros:

Establishes a baseline of AI accountability in Canada.
Aligns Canada with international movement (EU AI Act, U.S. Executive Orders).
Creates potential for interoperable global AI governance.

Cons:

Many key definitions (including "high-impact system") are left to future regulation, creating uncertainty.
The AI and Data Commissioner sits inside ISED rather than being fully independent.
Critics argue AIDA was added late and should have been a standalone, more thoroughly consulted bill.

Who Is Affected by Bill C-27?

The practical reach of Bill C-27 is broad. Organizations most impacted include:

E-commerce and retail handling customer accounts, purchase histories, and marketing data.
SaaS and digital platforms, including analytics, link management, and marketing tools.
Financial institutions using AI for credit scoring or fraud detection.
Healthcare technology companies operating in the private sector.
HR tech vendors deploying algorithmic screening tools.
Marketers and agencies handling first-party data, cookies, and attribution.

Even small businesses are not exempt. The CPPA scales obligations with the volume and sensitivity of data handled, but the fundamental duties — consent, transparency, security, breach notification — apply broadly.

How to Prepare: A Practical Checklist

Even though Bill C-27 is not yet in force, organizations that wait until Royal Assent will be scrambling. The following steps are reasonable to start now:

Map your data. Know what personal information you collect, where it lives, who can access it, and how long you retain it.
Review consent mechanisms. Ensure plain-language explanations tied to specific purposes.
Draft or update your privacy management program. Appoint an accountable individual.
Inventory automated decision systems. Document inputs, logic, and expected outcomes.
Harden breach response. Test your incident response plan annually.
Review vendor contracts. Processors and sub-processors must meet comparable standards.
Minimize data collection. The less sensitive data you hold, the lower your risk and compliance cost.

The Marketing and Link-Tracking Angle

Marketers should pay special attention to how tracking pixels, UTM parameters, and shortened URLs interact with CPPA consent rules. If a shortened link collects IP addresses, device data, or referrer information tied to an identifiable individual, that collection falls within scope.

Choosing privacy-conscious tooling matters. A link management platform like Lunyb gives Canadian marketers branded short links and analytics without the heavy third-party tracking footprint of some older platforms — a useful property as consent rules tighten. If you're evaluating options, our 2026 buyer's guide to URL shorteners breaks down the trade-offs in detail, and our honest review of Lunyb walks through its privacy posture specifically. For a comparison point, see our Rebrandly 2026 review.

Current Status and Timeline

Bill C-27 has moved through multiple rounds of committee study, with substantial amendments proposed to AIDA in particular. The exact date of Royal Assent remains uncertain due to the usual rhythm of Canadian parliamentary business and periodic prorogations. Once passed, the CPPA and Tribunal provisions are expected to have a transition period — likely 12 to 24 months — before full enforcement. AIDA's substantive obligations are expected to be phased in even more gradually, with regulations defining "high-impact systems" issued separately.

Organizations should assume the direction of travel is settled even if the exact deadline is not. The combination of EU adequacy pressure, Quebec's Law 25 (already in force), and public expectation makes a return to the PIPEDA-only status quo implausible.

Interaction with Quebec's Law 25

Quebec's Law 25 (formerly Bill 64) has been progressively taking effect since 2022 and already imposes GDPR-like requirements on organizations doing business in the province — including mandatory privacy impact assessments, explicit consent for sensitive data, and the right to data portability. Businesses operating nationally must comply with Law 25 today regardless of Bill C-27's status, and much of the work done for Law 25 will directly carry over to CPPA readiness.

Frequently Asked Questions

Is Bill C-27 law yet?

As of 2026, Bill C-27 has not received Royal Assent. It remains in the parliamentary process and has been subject to extensive committee review and amendment. However, its core direction is widely expected to become law, and organizations should prepare accordingly.

What is the biggest difference between PIPEDA and the CPPA?

The biggest practical difference is enforcement. PIPEDA caps fines at CAD $100,000 and relies largely on Federal Court action. The CPPA introduces administrative monetary penalties of up to 3% of global revenue and offence-based fines up to 5% — a scale that transforms privacy from a reputational concern into a boardroom financial risk.

Does Bill C-27 apply to small businesses?

Yes. There is no blanket small-business exemption. However, the required privacy management program must be proportionate to the volume and sensitivity of personal information handled, so a small café's obligations will be far lighter than a national retailer's.

How does AIDA compare to the EU AI Act?

Both take a risk-based approach focused on high-impact systems, but the EU AI Act is more detailed, categorizes risk into explicit tiers (unacceptable, high, limited, minimal), and includes specific bans. AIDA is a lighter framework that leaves many details to future regulation. Organizations operating in both jurisdictions will generally find EU AI Act compliance covers most AIDA requirements.

What should Canadian businesses do right now?

Start with a data inventory, review and document consent practices, appoint a privacy accountable person, and inventory any automated decision-making systems. If you operate in Quebec, achieving Law 25 compliance will put you most of the way toward CPPA readiness. Choose vendors and tools that minimize unnecessary data collection by default.

Final Thoughts

Bill C-27 represents a long-overdue modernization of Canadian privacy and data law. While its path through Parliament has been uneven, the regulatory direction is clear: stronger individual rights, meaningful penalties, formal AI governance, and alignment with international standards. Organizations that invest in privacy maturity now — regardless of when exactly the bill passes — will be better positioned not only for compliance but for the customer trust that increasingly drives digital business in Canada.