Privacy Rights in Canada 2026: Your Complete Guide to Data Protection

Canada's privacy landscape has evolved dramatically heading into 2026, with modernised legislation, stronger enforcement powers for the Office of the Privacy Commissioner (OPC), and growing public awareness of digital rights. Whether you're a consumer worried about how your data is collected, a business trying to stay compliant, or simply curious about what Canadian law says about your personal information, this guide covers everything you need to know about privacy rights in Canada in 2026.

Overview of Privacy Rights in Canada in 2026

Privacy rights in Canada are the legal protections that govern how personal information is collected, used, disclosed, and stored by governments, businesses, and other organisations. These rights are rooted in both federal and provincial legislation, as well as the Canadian Charter of Rights and Freedoms.

In 2026, Canadians benefit from a multi-layered privacy framework that includes:

• The Personal Information Protection and Electronic Documents Act (PIPEDA) — the federal private-sector law.
• The Privacy Act — governing federal government handling of personal information.
• Bill C-27 (the Digital Charter Implementation Act) — modernising private-sector privacy law, artificial intelligence governance, and creating a data protection tribunal.
• Provincial statutes in Quebec, British Columbia, Alberta, and Ontario (for health information).
• Sector-specific rules for health, financial, and telecommunications data.

Together, these instruments give Canadians the right to know what data is collected about them, to consent to its use, to access and correct it, and to seek redress when things go wrong.

The Federal Framework: PIPEDA and Bill C-27

PIPEDA in 2026

PIPEDA continues to serve as the baseline federal law for private-sector organisations that collect, use, or disclose personal information in the course of commercial activity. It applies across provinces that do not have their own "substantially similar" private-sector legislation.

Under PIPEDA, ten fair information principles guide compliance: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.

The Consumer Privacy Protection Act (CPPA) under Bill C-27

Bill C-27, which advanced significantly through Parliament in 2024–2025, introduces the Consumer Privacy Protection Act (CPPA) to replace much of PIPEDA. Key features Canadians should understand in 2026 include:

1. Stronger consent requirements: Organisations must obtain clear, plain-language consent for specific purposes.
2. The right to data mobility: Individuals can request that their data be transferred between service providers.
3. The right to disposal (deletion): Canadians can request that organisations delete their personal information.
4. Algorithmic transparency: Individuals can ask for an explanation when an automated decision-making system is used to make significant decisions about them.
5. Significant fines: Penalties of up to 5% of global revenue or CAD $25 million, whichever is higher, for serious violations.

Bill C-27 also creates the Personal Information and Data Protection Tribunal, an appeals body that adds a new layer of enforcement between the OPC and the Federal Court.

The Artificial Intelligence and Data Act (AIDA)

The third component of Bill C-27 is AIDA, which regulates "high-impact" AI systems. In 2026, businesses developing or deploying AI tools that make consequential decisions — hiring, credit, healthcare — must implement risk assessments, mitigation measures, and transparency documentation.

Provincial Privacy Laws Canadians Should Know

Not all privacy law in Canada is federal. Several provinces operate their own regimes that apply instead of PIPEDA within their borders.

Quebec: Law 25

Quebec's Law 25 (formerly Bill 64) is now fully in force and is widely considered the strictest privacy law in Canada. In 2026 it grants Quebec residents:

• A robust right to data portability.
• The right to de-indexing (a limited "right to be forgotten").
• Mandatory privacy impact assessments for organisations.
• Fines up to CAD $25 million or 4% of worldwide turnover.

British Columbia and Alberta

Both provinces have Personal Information Protection Acts (PIPAs) that mirror many PIPEDA principles but include their own commissioners and complaint processes. Alberta's PIPA has notably strong mandatory breach reporting requirements.

Ontario's Health Sector

Ontario's Personal Health Information Protection Act (PHIPA) governs how hospitals, clinics, and other health custodians handle patient records. Ontario has also signalled continued interest in a broader private-sector privacy law, and public consultations continue into 2026.

Your Core Privacy Rights as a Canadian in 2026

Regardless of which specific law applies, Canadians generally enjoy the following core rights:

1. The right to know what personal information an organisation holds about you and why.
2. The right to consent — meaningful, informed consent before your data is collected, used, or shared.
3. The right to access your personal information and receive a copy in a usable format.
4. The right to correction of inaccurate or incomplete data.
5. The right to withdraw consent at any time, subject to legal or contractual restrictions.
6. The right to complain to the OPC or a provincial commissioner.
7. The right to be notified of a data breach that poses a real risk of significant harm.
8. The right to data mobility and deletion under the CPPA and Quebec's Law 25.

Comparing Canadian Privacy Laws at a Glance

Law	Scope	Max Penalty	Notable 2026 Feature
PIPEDA	Federal private sector	CAD $100,000 per violation	Being replaced by CPPA
CPPA (Bill C-27)	Federal private sector	5% global revenue or $25M	Data mobility & deletion rights
AIDA (Bill C-27)	High-impact AI systems	Up to 5% global revenue	AI risk assessments required
Quebec Law 25	Quebec-based orgs	4% global revenue or $25M	Right to de-indexing
BC/Alberta PIPA	Provincial private sector	Up to $100,000	Mandatory breach reporting
PHIPA (Ontario)	Health information	Up to $200,000 (individuals)	Electronic audit logs

Data Breach Rules and Notification

Since PIPEDA's breach reporting provisions took effect, Canadian organisations must:

1. Report breaches of security safeguards involving personal information to the OPC when there is a real risk of significant harm (RROSH).
2. Notify affected individuals as soon as feasible.
3. Keep records of all breaches — even those not reported — for a minimum of 24 months.

Under the CPPA, these obligations are strengthened, with clearer timelines and higher penalties for failure to notify. Quebec's Law 25 adds a requirement to notify the Commission d'accès à l'information (CAI) and to maintain a breach register.

Cross-Border Data Transfers

Canadians increasingly use services hosted outside the country, particularly in the United States and the EU. In 2026, cross-border transfer rules require organisations to:

• Disclose that data may be processed outside Canada.
• Ensure comparable protection through contractual clauses.
• Conduct privacy impact assessments before transferring sensitive data internationally (mandatory in Quebec).

Canada's adequacy status with the EU under the GDPR remains a critical component of trade, and the modernisation efforts in Bill C-27 are partly aimed at preserving that recognition.

Practical Steps to Protect Your Privacy Online

Legal rights matter, but real-world privacy also depends on the choices you make every day. Here are practical steps Canadians can take in 2026:

1. Understand What You're Sharing

Before signing up for any service, read the privacy notice. Look for what data is collected, how it's used, whether it's sold or shared, and how long it's retained.

2. Use Privacy-Respecting Tools

Consider encrypted messaging apps, privacy-focused browsers, encrypted DNS services, and password managers. When sharing links — particularly for marketing, social media, or newsletters — use a shortener that respects your privacy and doesn't build hidden tracking profiles. Tools like Lunyb offer clean URL shortening with transparent analytics, which is a smart alternative to shorteners that quietly monetise click data. You can read our honest review of Lunyb or compare options in our 2026 buyer's guide to URL shorteners.

3. Exercise Your Access Rights

You can send a formal written request to any organisation asking for a copy of the personal information they hold about you. They generally must respond within 30 days.

4. Check Cookie and Tracking Settings

Under the CPPA and Law 25, consent for tracking cookies must be meaningful. Regularly review browser settings and opt out of unnecessary tracking.

5. Secure Your Accounts

Enable multi-factor authentication, use strong unique passwords, and monitor your credit and financial accounts for unauthorised activity.

How to File a Privacy Complaint in Canada

If you believe your privacy rights have been violated, you have several paths:

1. Contact the organisation first. Ask to speak with their privacy officer.
2. File a complaint with the OPC at priv.gc.ca if the organisation is federally regulated or operates in a province without substantially similar legislation.
3. File with the provincial commissioner in Quebec (CAI), Alberta (OIPC), or British Columbia (OIPC) as applicable.
4. Appeal to the Data Protection Tribunal once Bill C-27 is fully operational.
5. Pursue civil remedies including statutory damages under the CPPA and Law 25.

What's Next for Canadian Privacy Law

Looking beyond 2026, several trends are shaping the future of Canadian privacy:

• AI governance will continue to expand, with more sector-specific guidance from the OPC on generative AI, facial recognition, and biometrics.
• Children's privacy is receiving increased scrutiny, with proposed rules limiting targeted advertising to minors.
• Workplace surveillance laws — following Ontario's lead — are expanding, requiring employers to disclose electronic monitoring practices.
• Interoperability with global frameworks like the EU's AI Act and the U.S. state-level privacy patchwork will shape Canadian compliance obligations.

Frequently Asked Questions

Is PIPEDA still in force in 2026?

Yes. PIPEDA remains in force in 2026, although the Consumer Privacy Protection Act (CPPA) introduced under Bill C-27 is progressively replacing it. Organisations should prepare for a full transition and comply with whichever framework applies to them.

Do Canadians have a "right to be forgotten"?

Not in the full European sense, but Canadians have related rights. Quebec's Law 25 includes a limited de-indexing right, and the CPPA introduces a right to disposal that allows individuals to request deletion of their personal information under certain conditions.

What should I do if a company refuses my data access request?

First, ask for a written explanation. If you're not satisfied, file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner. Under Bill C-27, you may also have access to the Data Protection Tribunal for appeals.

Are Canadian privacy rights the same across every province?

No. While federal law provides a baseline, Quebec, British Columbia, and Alberta have their own private-sector privacy laws with different requirements. Quebec's Law 25 is currently the most stringent. Ontario has sector-specific laws, particularly for health information.

How much can a business be fined for breaking privacy law in Canada?

Under the CPPA, penalties can reach 5% of global revenue or CAD $25 million, whichever is higher, for the most serious violations. Quebec's Law 25 has similar maximum penalties. These are among the highest privacy fines in the world outside the EU's GDPR.

Final Thoughts

Privacy rights in Canada in 2026 are stronger, clearer, and more enforceable than ever before. Between the modernised federal framework under Bill C-27, Quebec's rigorous Law 25, and continued provincial innovation, Canadians have meaningful tools to control their personal information. The key is knowing your rights — and using them. Combine legal literacy with strong personal security habits and privacy-respecting tools, and you'll be well-positioned to protect yourself in an increasingly data-driven world.