Bill C-27 Digital Charter: What You Need to Know in 2026

Canada's privacy and data protection framework is undergoing its most significant overhaul in more than two decades. At the centre of that transformation is Bill C-27, the Digital Charter Implementation Act. If you run a business that collects personal information, build artificial intelligence systems, or simply want to understand your rights as a Canadian consumer, this legislation will shape how your data is handled for years to come.

This guide breaks down what Bill C-27 is, what it changes, who it affects, and how to prepare — in plain English.

What Is Bill C-27?

Bill C-27, formally titled the Digital Charter Implementation Act, 2022, is a federal Canadian bill that modernises the country's private-sector privacy law and introduces the first federal framework for regulating artificial intelligence. It was tabled by the Government of Canada to replace the aging Personal Information Protection and Electronic Documents Act (PIPEDA) with rules more suited to today's digital economy.

The bill is actually a bundle of three separate pieces of legislation rolled into one:

The Consumer Privacy Protection Act (CPPA) — replaces Part 1 of PIPEDA and governs how private-sector organisations collect, use, and disclose personal information.
The Personal Information and Data Protection Tribunal Act — creates a new specialised tribunal to hear appeals and impose administrative monetary penalties.
The Artificial Intelligence and Data Act (AIDA) — introduces Canada's first federal rules for designing, developing, and deploying "high-impact" AI systems.

Together, these three acts form the legislative backbone of the broader Digital Charter, a 10-principle policy framework Ottawa first announced in 2019 to promote trust in the digital economy.

Why Bill C-27 Matters

PIPEDA was enacted in 2000, long before smartphones, social media, cloud computing, and generative AI. Canadian regulators, consumer advocates, and even industry groups have widely agreed that the law is outdated. Bill C-27 matters because it:

Aligns Canada more closely with the European Union's General Data Protection Regulation (GDPR), helping preserve Canada's "adequacy" status for international data transfers.
Introduces meaningful financial penalties — up to 5% of global revenue or $25 million, whichever is greater — for the most serious violations.
Gives Canadians new rights, including data portability and the ability to request deletion of personal information.
Establishes the first federal guardrails for AI systems that could cause harm.
Creates clearer rules for the use of children's personal information, treating it as "sensitive" by default.

Key Changes Under the Consumer Privacy Protection Act (CPPA)

The CPPA is the heart of Bill C-27 and will have the most immediate impact on businesses and consumers. Below are the most important shifts compared with PIPEDA.

1. Stronger, Plain-Language Consent

Organisations must obtain consent in plain language at or before the time personal information is collected. Long, dense privacy policies written in legalese will no longer satisfy the standard. Consent requests must clearly explain:

The purposes of collection, use, or disclosure
The specific type of personal information involved
Any reasonably foreseeable consequences
The names of third parties to whom information may be disclosed

2. New Right to Deletion (Disposal)

Canadians will have the right to request that an organisation dispose of their personal information. There are limited exceptions — for example, legal obligations to retain records — but overall this brings Canada closer to the GDPR's "right to be forgotten."

3. Data Mobility (Portability)

Individuals can request that their personal information be transferred from one organisation to another, provided both are subject to a data mobility framework. This is intended to reduce lock-in and promote competition.

4. Algorithmic Transparency

If an organisation uses an automated decision system to make a prediction, recommendation, or decision that could have a significant impact on an individual, that person can request an explanation. This includes things like credit decisions, insurance pricing, and hiring algorithms.

5. Enhanced Protections for Minors

The CPPA explicitly treats the personal information of minors as "sensitive information," which triggers heightened obligations around consent, retention, and security safeguards.

6. Mandatory Privacy Management Programs

Every organisation subject to the CPPA must implement and maintain a documented privacy management program proportionate to its size and the sensitivity of the information it handles.

CPPA vs. PIPEDA: A Side-by-Side Comparison

Area	PIPEDA (Current)	CPPA (Under Bill C-27)
Maximum Penalty	$100,000 per violation	Up to 5% of global revenue or $25M
Right to Deletion	Not explicit	Yes, with limited exceptions
Data Portability	Not included	Yes, via mobility frameworks
Automated Decision-Making	No specific rules	Right to explanation
Children's Data	Treated like adult data	Treated as sensitive
Enforcement Body	OPC with court referral	OPC + new Data Protection Tribunal
De-identified Data	Loosely defined	Defined with specific obligations

The Artificial Intelligence and Data Act (AIDA)

AIDA is the most forward-looking — and most debated — component of Bill C-27. It introduces obligations for organisations that design, develop, make available, or manage the operation of "high-impact" AI systems.

What Counts as a "High-Impact" System?

The bill originally left this term to be defined by regulation, which drew criticism from industry and civil society alike. Later government amendments proposed seven categories, including AI used in:

Employment decisions (hiring, promotion, termination)
Delivery of essential services (banking, insurance)
Biometric identification and inference
Content moderation and prioritisation on large platforms
Healthcare and medical devices
Decisions by courts and administrative bodies
Law enforcement applications

Core AIDA Obligations

Risk assessment and mitigation: Identify and address risks of harm or biased output.
Monitoring and record-keeping: Continuously evaluate system performance and keep documentation.
Transparency: Publish plain-language descriptions of high-impact AI systems and how they are used.
Incident reporting: Notify the Minister of material harm caused by a system.

Penalties under AIDA can reach the greater of $25 million or 5% of global revenue for regulatory offences, with additional criminal offences — including fines and imprisonment — for reckless or fraudulent use of AI that causes serious harm.

The New Data Protection Tribunal

Bill C-27 creates a Personal Information and Data Protection Tribunal made up of three to six members, at least three of whom must have experience in information and privacy law. The tribunal will:

Hear appeals of findings and orders made by the Privacy Commissioner
Impose administrative monetary penalties recommended by the Commissioner
Operate as a specialised, more accessible alternative to the Federal Court

This two-tiered model (Commissioner investigates and recommends; Tribunal enforces) is a significant departure from PIPEDA's largely ombudsperson-style enforcement.

Who Does Bill C-27 Apply To?

The CPPA applies to every private-sector organisation that collects, uses, or discloses personal information in the course of commercial activities across Canada — plus federally regulated employers for employee information. Provinces with "substantially similar" laws (Quebec, Alberta, British Columbia) will continue to regulate purely intra-provincial activity, but federal rules kick in for interprovincial and international data flows.

AIDA applies to "regulated activities" involving AI systems in the course of international or interprovincial trade and commerce — so most meaningful commercial AI deployments in Canada will fall within scope.

How Bill C-27 Affects Canadian Consumers

For everyday Canadians, Bill C-27 means more control over personal data and clearer recourse when something goes wrong. Expect to see:

Shorter, clearer consent pop-ups and privacy notices
Easier access to your own data, including export options
The ability to delete accounts and associated data on request
Explanations when algorithms make significant decisions about you
Stronger safeguards for your children's information

In the meantime, you don't have to wait for legislation to take better control of your digital footprint. Using privacy-respecting tools — encrypted DNS resolvers, private browsers, hardware security keys, and link management platforms like Lunyb that avoid aggressive tracking — can meaningfully reduce the amount of data being collected about you today. You can read our transparency review in Is Lunyb Legit? An Honest Review for more context.

How Businesses Should Prepare

Even though Bill C-27 is not yet fully in force, waiting until royal assent to act would be a mistake. Here is a practical preparation roadmap.

1. Map Your Data

Build a complete inventory of the personal information you collect, where it is stored, who can access it, how long you keep it, and which third parties receive it. You cannot comply with deletion, portability, or transparency obligations if you don't know where data lives.

2. Rewrite Privacy Notices in Plain Language

Audit every consent flow, privacy policy, and cookie banner. Rewrite them in clear, concise language and make sure purposes are specific — not catch-all phrases like "for business purposes."

3. Build a Formal Privacy Management Program

Document policies for consent, retention, security, breach response, complaints handling, employee training, and vendor management. Appoint an individual (often called a Privacy Officer) accountable for the program.

4. Prepare for New Individual Rights

Create intake workflows for access, correction, deletion, and portability requests, including identity verification steps and response-time tracking. Thirty days remains a reasonable internal service standard.

5. Inventory Your AI Systems

If you use or build AI, classify each system against AIDA's proposed high-impact categories. For anything that qualifies, start documenting training data sources, intended use, known limitations, bias testing, and monitoring procedures.

6. Review Vendor Contracts

Processors and service providers must offer protection "equivalent" to what your organisation provides. Update contracts to address breach notification, sub-processing, cross-border transfers, and deletion on termination.

7. Strengthen Marketing and Link-Tracking Practices

Marketing teams should audit their analytics, pixels, and link-tracking stack. Prefer vendors that minimise personal data collection and offer clear data processing terms. For link shortening and campaign tracking, privacy-conscious platforms such as Lunyb can help reduce exposure. For broader comparisons, see our Best URL Shorteners Buyer's Guide and the detailed Rebrandly Review 2026.

Criticisms and Ongoing Debate

Bill C-27 has not been without controversy. Key critiques include:

AIDA was drafted too quickly — critics argue AI governance should have been a standalone bill with broader consultation.
Definition gaps — many important terms, including "high-impact system," are left to future regulation.
Enforcement complexity — the Commissioner-plus-Tribunal structure may slow down resolution of complaints.
Children's privacy — some advocates want age-specific rules rather than a general "sensitive" designation.
Private right of action — the CPPA includes one, but only after the Commissioner and Tribunal have ruled, which may limit its practical use.

Timeline and Current Status

Bill C-27 was introduced in June 2022 and spent extensive time in committee study. Its passage has been affected by parliamentary scheduling and prorogation, meaning the exact implementation timeline remains in flux. When the legislation does pass, expect a transition period — likely 12 to 24 months — before full enforcement begins, along with additional regulations fleshing out key definitions.

Organisations should treat the current period as a planning window, not a pause.

Frequently Asked Questions

Is Bill C-27 the same as PIPEDA?

No. Bill C-27 is proposed legislation that would replace Part 1 of PIPEDA with the Consumer Privacy Protection Act, add new AI rules through AIDA, and create a dedicated Data Protection Tribunal. Until it passes and comes into force, PIPEDA remains Canada's federal private-sector privacy law.

How much can my business be fined under Bill C-27?

Administrative monetary penalties for serious contraventions can reach the greater of $10 million or 3% of global gross revenue. For the most serious offences — including obstruction and knowing violations — fines can rise to the greater of $25 million or 5% of global gross revenue. AIDA mirrors those upper limits for high-impact AI violations.

Does Bill C-27 apply to small businesses?

Yes. The CPPA applies to any organisation engaged in commercial activity, regardless of size. However, obligations like privacy management programs must be "proportionate" to the volume and sensitivity of data handled, so small businesses will not face the same documentation burden as large enterprises.

How does Bill C-27 compare to the GDPR?

Bill C-27 draws heavy inspiration from the GDPR, including rights to deletion, portability, and explanation, plus revenue-based fines. However, the CPPA is generally less prescriptive than the GDPR, keeps consent as the primary legal basis (rather than offering six bases), and introduces a unique two-tier enforcement structure with the Tribunal.

What should I do right now to prepare?

Start with a data inventory, rewrite your privacy notices in plain language, document a formal privacy management program, and classify any AI systems you use. Also audit your marketing and analytics vendors to ensure they minimise personal data collection and can support deletion and access requests.

Final Thoughts

Bill C-27 represents a long-overdue modernisation of Canadian privacy law and the country's first serious attempt to regulate artificial intelligence. For consumers, it promises stronger rights and more transparent handling of personal data. For businesses, it raises the compliance bar significantly — but it also offers clarity and alignment with international standards that will make cross-border operations easier over time.

The organisations that treat Bill C-27 as a strategic opportunity rather than a compliance burden will be the ones best positioned to earn customer trust in the years ahead.