Privacy Rights in Canada 2026: A Complete Guide for Individuals and Businesses

Privacy rights in Canada have entered a new era. With Bill C-27 reshaping the federal privacy landscape, Quebec's Law 25 fully in force, and evolving provincial rules in British Columbia, Alberta, and Ontario, 2026 marks one of the most consequential years for Canadian data protection since PIPEDA was introduced. This guide breaks down what your privacy rights look like today, what obligations businesses face, and how individuals can take practical steps to safeguard their personal information.

What Are Privacy Rights in Canada?

Privacy rights in Canada refer to the legal protections that govern how personal information is collected, used, disclosed, and stored by governments, businesses, and other organizations. These rights are grounded in federal statutes, provincial legislation, and constitutional principles derived from the Canadian Charter of Rights and Freedoms.

At the federal level, two main laws apply: the Privacy Act, which governs how federal government institutions handle personal information, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to private-sector organizations engaged in commercial activity. In 2026, PIPEDA is being progressively replaced by the Consumer Privacy Protection Act (CPPA) under Bill C-27.

The Legal Framework Governing Privacy in Canada in 2026

Canada operates under a layered privacy system. Federal laws set a national floor, while provinces can enact their own legislation that must be "substantially similar" to federal rules. Here is how the framework stacks up in 2026.

Federal Legislation

PIPEDA — Still the primary federal private-sector privacy law during the transition period.
Bill C-27 / Digital Charter Implementation Act — Introduces the CPPA, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA).
Privacy Act — Governs federal government handling of personal information.
Canada's Anti-Spam Legislation (CASL) — Regulates commercial electronic messages and consent.

Provincial Legislation

Quebec Law 25 — The most comprehensive provincial law, now fully in effect with strict consent, transparency, and data portability requirements.
British Columbia PIPA — Applies to private-sector organizations in BC.
Alberta PIPA — Alberta's counterpart with mandatory breach notification.
Ontario — Has sector-specific laws such as PHIPA for health information; a general private-sector law remains under discussion.

Core Privacy Rights Canadians Have in 2026

Canadians enjoy a defined set of privacy rights that any organization handling their data must respect. These rights are largely consistent across federal and provincial regimes, though enforcement mechanisms vary.

1. The Right to Be Informed

Organizations must clearly explain what personal information they collect, why they need it, and how it will be used or disclosed. Privacy notices must be written in plain language — a requirement strengthened under both the CPPA and Quebec's Law 25.

2. The Right to Consent

Consent must be meaningful. Under the CPPA, consent must be obtained in plain language at or before the time of collection, and individuals must understand the nature, purpose, and consequences of the collection. Implied consent is increasingly restricted for sensitive data.

3. The Right to Access Your Data

Any Canadian can ask an organization what personal information it holds about them, how it has been used, and to whom it has been disclosed. Organizations generally must respond within 30 days.

4. The Right to Correction

If personal information is inaccurate or incomplete, individuals have the right to have it corrected. If a dispute cannot be resolved, a notation must be added.

5. The Right to Data Portability

New under the CPPA and already active under Quebec Law 25, this right allows individuals to request that their data be transferred to another organization in a structured, commonly used format.

6. The Right to Deletion (Disposal)

The CPPA introduces an explicit right to have personal information disposed of upon request, subject to legal or contractual exceptions.

7. The Right to Algorithmic Transparency

When an automated decision-making system is used to make a significant decision about an individual, they have the right to an explanation of how the decision was made and what factors influenced it.

Bill C-27 and the Consumer Privacy Protection Act

Bill C-27, formally the Digital Charter Implementation Act, is the most significant privacy reform in Canada in over two decades. It replaces Part 1 of PIPEDA with the CPPA and creates a dedicated tribunal for privacy enforcement.

Key Changes Under the CPPA

Substantially higher penalties — up to 5% of global revenue or $25 million, whichever is greater, for the most serious violations.
Expanded rights for individuals, including disposal and portability.
Mandatory privacy management programs for organizations.
Stricter rules on de-identified and anonymized data.
Enhanced protections for minors, treating children's data as inherently sensitive.

The Artificial Intelligence and Data Act (AIDA)

AIDA, bundled within Bill C-27, introduces obligations for organizations deploying "high-impact" AI systems, including risk assessments, transparency requirements, and human oversight — all of which intersect with privacy rights when AI processes personal information.

Comparison: PIPEDA vs. CPPA vs. Quebec Law 25

Feature	PIPEDA (current)	CPPA (Bill C-27)	Quebec Law 25
Maximum Penalty	$100,000	5% of global revenue or $25M	4% of global revenue or $25M
Right to Deletion	Limited	Yes, explicit	Yes
Data Portability	No	Yes	Yes
Automated Decision Explanations	No	Yes	Yes
Mandatory Privacy Officer	Recommended	Required	Required
Breach Notification	Yes	Yes	Yes
Consent Standard	Meaningful consent	Plain-language, informed	Express, granular

Business Obligations Under Canadian Privacy Law in 2026

Any business collecting personal data from Canadians — whether based in Canada or abroad — must comply with applicable federal and provincial rules. Here is what compliance looks like in 2026.

1. Appoint a Privacy Officer

Every organization must designate someone accountable for privacy compliance. Under Quebec Law 25, this individual's name and contact details must be publicly available.

2. Conduct Privacy Impact Assessments (PIAs)

PIAs are now mandatory in Quebec for any new system or project involving personal information, and are considered best practice federally.

3. Maintain a Privacy Management Program

Documented policies, employee training, incident response plans, and vendor management processes are all expected under the CPPA.

4. Report Breaches Promptly

Breaches presenting a "real risk of significant harm" must be reported to the Privacy Commissioner and to affected individuals as soon as feasible. Records of all breaches — reportable or not — must be kept for at least two years.

5. Manage Cross-Border Data Transfers

Organizations transferring personal data outside Canada must ensure comparable protections through contractual and organizational safeguards. Quebec Law 25 explicitly requires an impact assessment before any transfer outside the province.

How Individuals Can Protect Their Privacy in 2026

Legal rights are only part of the picture. Practical, day-to-day habits play an equally important role in protecting your personal information online.

Read privacy notices before consenting. Under new plain-language rules, they should be shorter and clearer than in the past.
Exercise your rights. Request access, correction, portability, or deletion from organizations holding your data.
Use encrypted DNS and privacy-respecting browsers. Tools like Firefox, Brave, and DNS-over-HTTPS reduce tracking at the network level.
Limit link exposure. When sharing links publicly, consider using a privacy-respecting shortener such as Lunyb, which lets you share URLs without exposing underlying tracking parameters or long query strings. Read our honest review of Lunyb for more detail.
Enable multi-factor authentication on all accounts that support it.
Review app permissions regularly on mobile devices.
File complaints when necessary. The Office of the Privacy Commissioner of Canada (OPC) and provincial commissioners investigate complaints free of charge.

Sector-Specific Privacy Considerations

Health Information

Provincial health privacy laws such as Ontario's PHIPA, Alberta's HIA, and Quebec's health data rules impose strict standards on health custodians. Consent for secondary uses of health data has become significantly stricter in 2026.

Employment Privacy

Employees in Quebec, British Columbia, and Alberta benefit from specific workplace privacy protections. Employers must justify monitoring, notify employees, and limit data collection to what is reasonably necessary.

Marketing and Link Tracking

CASL continues to require express consent for most commercial electronic messages. Marketers who use tracking links, redirects, or shortened URLs should ensure their tracking practices align with consent-based rules. Businesses looking to compare tools can review our 2026 buyer's guide to URL shorteners or the detailed Rebrandly review.

Enforcement: What Happens When Privacy Rights Are Violated

The enforcement landscape has changed dramatically. Under PIPEDA, the OPC's role was largely investigative and its orders non-binding. Under the CPPA, enforcement becomes far more consequential.

The New Enforcement Chain

Individuals file complaints with the OPC or a provincial commissioner.
The commissioner investigates and can issue binding orders.
The new Personal Information and Data Protection Tribunal reviews penalties.
Serious offences can be prosecuted with fines up to $25 million or 5% of global revenue.
A private right of action allows individuals to sue for damages after regulatory findings.

Emerging Privacy Issues to Watch in 2026

Generative AI and training data — The OPC has opened investigations into how large language models handle Canadian personal data.
Biometric surveillance — Facial recognition use by police and retailers remains under close scrutiny.
Children's privacy — Enhanced protections and design standards for platforms used by minors.
Cross-border data flows — Increasing alignment between Canadian rules and the EU's GDPR to maintain adequacy status.
Dark patterns — Deceptive interface designs that manipulate consent are increasingly viewed as invalidating consent altogether.

Frequently Asked Questions

Is PIPEDA still in effect in 2026?

Yes. PIPEDA remains in force during the transition to the Consumer Privacy Protection Act. Once the CPPA is fully proclaimed, it will replace Part 1 of PIPEDA for private-sector data handling. Organizations should be preparing now for CPPA compliance.

Do Canadian privacy laws apply to foreign companies?

Yes. If an organization collects, uses, or discloses the personal information of Canadians in the course of commercial activity, Canadian privacy law applies regardless of where the company is headquartered. Quebec Law 25 is particularly assertive about extraterritorial reach.

What is the fine for a privacy breach in Canada?

Under current PIPEDA rules, fines are capped at $100,000. Under the CPPA, administrative monetary penalties can reach the greater of $10 million or 3% of global revenue, and for the most serious offences, up to $25 million or 5% of global revenue. Quebec Law 25 imposes similar upper limits.

How do I file a privacy complaint?

You can file a complaint with the Office of the Privacy Commissioner of Canada online, by mail, or by phone. For provincial matters, contact the relevant provincial commissioner (Quebec's CAI, BC's OIPC, or Alberta's OIPC). Complaints are free, and you do not need a lawyer to file one.

What rights do I have over automated decisions made about me?

Under the CPPA and Quebec Law 25, if a significant decision about you is made solely by an automated system — such as loan approvals or insurance pricing — you have the right to be informed, to receive an explanation of the main factors, and in many cases to request human review.

Final Thoughts

Privacy rights in Canada in 2026 are stronger, clearer, and more enforceable than at any point in the country's history. For individuals, this means real leverage over how personal data is handled. For businesses, it means the compliance bar is higher and the cost of getting it wrong is significant. Whether you are drafting a privacy policy, responding to an access request, or simply choosing which tools to use online, understanding your rights and obligations is the foundation of digital trust in Canada.