Privacy Rights in Canada 2026: A Complete Guide for Individuals and Businesses

Privacy rights in Canada are evolving faster than ever. With Bill C-27 reshaping the federal landscape, provincial laws tightening in Quebec, British Columbia, and Alberta, and new rules governing artificial intelligence and children's data, 2026 marks a turning point for how Canadians control their personal information. This guide explains your rights, your options, and the practical steps you can take to protect your data in the year ahead.

What Are Privacy Rights in Canada?

Privacy rights in Canada are the legal protections that give individuals control over how their personal information is collected, used, disclosed, and retained by organisations and governments. These rights are enshrined in a mix of federal statutes, provincial legislation, and constitutional principles under the Canadian Charter of Rights and Freedoms.

At the federal level, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs private sector handling of personal data, while the Privacy Act regulates federal government institutions. Provincial laws like Quebec's Law 25, Alberta's PIPA, and B.C.'s PIPA layer additional protections on top. In 2026, the pending Consumer Privacy Protection Act (CPPA) under Bill C-27 is poised to modernise the entire federal framework.

The Legal Framework Governing Privacy in 2026

Federal Laws

PIPEDA — still the primary federal private-sector privacy law in 2026, pending full replacement by the CPPA.
Privacy Act — applies to federal government departments and agencies.
Bill C-27 (Digital Charter Implementation Act) — introduces the CPPA, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA).

Provincial Laws

Quebec Law 25 — the strictest regime in Canada, with GDPR-style requirements, mandatory privacy impact assessments, and significant fines.
Alberta PIPA and British Columbia PIPA — substantially similar to PIPEDA, applying to provincially regulated private organisations.
Health-specific laws — Ontario's PHIPA, Nova Scotia's PHIA, and others govern personal health information.

Sectoral and Charter Protections

Section 8 of the Canadian Charter of Rights and Freedoms protects Canadians from unreasonable search and seizure, which the Supreme Court has interpreted to include a reasonable expectation of privacy in digital contexts, including anonymised internet subscriber data.

Your Core Privacy Rights in 2026

Regardless of which law applies, Canadians share a common set of privacy rights that organisations must respect. Here are the most important ones in 2026:

Right to be informed — You must be told, in plain language, why your personal information is being collected and how it will be used.
Right to consent — Organisations generally need your meaningful consent before collecting, using, or disclosing your personal data.
Right of access — You can request a copy of the personal information an organisation holds about you.
Right to correction — You can require inaccurate or incomplete information to be fixed.
Right to withdraw consent — You can revoke consent at any time, subject to legal or contractual limits.
Right to data portability — Under the CPPA, you will be able to move your data between service providers in a usable format.
Right to erasure (disposal) — The CPPA and Quebec Law 25 both create a right to deletion of personal information in defined circumstances.
Right to algorithmic transparency — When automated decision-making significantly affects you, you can request an explanation of how the decision was made.

What Bill C-27 Changes for Canadians

Bill C-27 is the most significant overhaul of Canadian privacy law in two decades. If and when its three components come fully into force, Canadians can expect sharper rules and much stronger enforcement.

Key Changes Under the CPPA

Stronger consent standards — Consent must be meaningful, with clear explanation of purpose, consequences, and third parties involved.
Enhanced rights for minors — Information of minors is deemed "sensitive" by default, triggering higher protection.
Massive penalties — Fines of up to 5% of global revenue or $25 million, whichever is greater, for the most serious violations.
Private right of action — Individuals can sue organisations for certain contraventions.
De-identification rules — Specific obligations when working with anonymised or pseudonymised data.

The Artificial Intelligence and Data Act (AIDA)

AIDA introduces risk-based rules for "high-impact" AI systems, requiring risk assessments, mitigation measures, record-keeping, and transparency notices. For Canadians, this means more visibility into when AI is used in hiring, credit decisions, healthcare, and content moderation.

Federal vs Provincial Privacy Laws: Quick Comparison

Law	Jurisdiction	Max Penalty	Private Right of Action	Right to Erasure
PIPEDA	Federal (private sector)	$100,000 per violation	Limited	No explicit right
CPPA (Bill C-27)	Federal (private sector)	Up to 5% global revenue or $25M	Yes	Yes
Quebec Law 25	Quebec	Up to 4% global revenue or $25M	Yes	Yes
Alberta PIPA	Alberta	$100,000	Limited	Limited
B.C. PIPA	British Columbia	$100,000	Limited	Limited

Quebec Law 25: The Canadian Gold Standard

Quebec's Law 25 (formerly Bill 64) is now fully in force in 2026 and sets the highest bar in Canada. It requires organisations to appoint a privacy officer, conduct privacy impact assessments for projects involving personal information, provide clear consent for cookies and tracking technologies, and offer data portability.

If your organisation operates nationally, aligning with Law 25 is often the simplest path to compliance across the country, because meeting its standards usually satisfies PIPEDA and the forthcoming CPPA as well.

Children's Privacy and Sensitive Data in 2026

Both the CPPA and Quebec Law 25 treat the personal information of minors as inherently sensitive. In practice this means:

Higher consent thresholds, often requiring parental or guardian consent.
Shorter retention periods and stricter purpose limitations.
Clear, age-appropriate privacy notices.
Mandatory privacy impact assessments for any product aimed at children.

Edtech providers, gaming platforms, and social apps serving Canadian users should expect increased scrutiny from both federal and provincial privacy commissioners.

Breach Notification Obligations

Organisations in Canada have had mandatory breach reporting obligations under PIPEDA since 2018, and these are tightening in 2026.

Assess the breach — Determine whether there is a real risk of significant harm.
Notify the Office of the Privacy Commissioner — As soon as feasible after discovery.
Notify affected individuals — Directly, with information on what happened and what they can do.
Notify other organisations — If they can help reduce the risk of harm (e.g. credit bureaus).
Maintain records — Keep a log of all breaches, even minor ones, for at least 24 months.

How Canadians Can Protect Their Privacy in 2026

Legal rights only go so far — practical habits make the biggest difference day to day.

Review Consent Settings Regularly

Audit the apps and services you use at least twice a year. Revoke permissions you no longer need, especially for location, microphone, contacts, and background data collection.

Use Privacy-Respecting Tools

Choose a browser with strong tracker blocking (Firefox, Brave, or Safari with privacy settings turned up).
Use encrypted DNS (DNS-over-HTTPS) to protect your browsing lookups.
Switch to an end-to-end encrypted messenger for sensitive conversations.
Use a password manager and enable multi-factor authentication everywhere.

Be Careful With the Links You Share

Links are a surprisingly common vector for privacy leaks. Long tracking URLs can expose email addresses, campaign identifiers, and session data. Using a reputable link management service like Lunyb lets you clean up tracking parameters, control who sees what, and swap destinations without resharing new links. If you want a closer look at how it stacks up, see our honest Lunyb review or our wider 2026 buyer's guide to URL shorteners.

Exercise Your Rights

If you want to know what a company holds on you, send a written access request. Canadian organisations generally have 30 days to respond. If you are unhappy, you can file a complaint with the Office of the Privacy Commissioner of Canada or your provincial commissioner.

What Businesses Need to Do in 2026

If you run a business that handles personal information of Canadians, compliance is no longer optional background work — it is a boardroom issue.

Appoint a privacy officer and publish their contact details.
Map your data flows — know what you collect, where it goes, who touches it, and how long you keep it.
Update consent mechanisms — plain language, granular choices, and clear opt-outs.
Conduct privacy impact assessments for new projects, especially those involving AI or children.
Review vendor contracts — ensure processors meet Canadian standards, including cross-border transfer safeguards.
Train your staff annually on privacy obligations and incident response.
Prepare a breach response plan you can actually execute within hours, not days.

Pros and Cons of Canada's 2026 Privacy Landscape

Pros

Stronger, GDPR-aligned rights for individuals.
Significant penalties finally give regulators real leverage.
Clear rules for AI and automated decision-making.
Enhanced protections for children and sensitive data.
Private right of action empowers individuals directly.

Cons

Fragmented federal/provincial rules create compliance complexity.
Small and medium businesses face proportionally heavy compliance costs.
Overlap between AIDA and sectoral regulators could lead to uncertainty.
Enforcement guidance is still catching up with the law.

Looking Ahead: Privacy Trends Beyond 2026

Expect continued convergence with international standards, especially the EU's GDPR and the UK's Data Protection framework. Data localisation debates will intensify, particularly around health and government data. Biometric regulation, deepfake rules, and worker surveillance limits are all on the policy agenda. For Canadians, the direction of travel is clear: more control, more transparency, and more accountability for organisations handling personal information.

FAQ: Privacy Rights in Canada 2026

Is PIPEDA still in force in 2026?

Yes. PIPEDA remains the main federal private-sector privacy law in 2026 until Bill C-27's Consumer Privacy Protection Act fully replaces it. Organisations should prepare now for the stricter CPPA standards.

Do Canadians have a "right to be forgotten"?

Partially. Quebec Law 25 and the forthcoming CPPA both include a right to request deletion or de-indexing of personal information in defined circumstances. It is not as broad as the EU right, but it is meaningful and enforceable.

What should I do if a company refuses my access request?

First, ask for the refusal in writing with the legal basis cited. If the response is unsatisfactory, you can file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner. Investigations are free for the complainant.

Are U.S. companies subject to Canadian privacy law?

Yes, if they collect, use, or disclose personal information about Canadians in the course of commercial activities. Jurisdiction can be asserted even without a physical presence in Canada, and enforcement cooperation with U.S. and EU regulators is increasing.

How can I check what data is being collected when I click a link?

Hover over links before clicking to inspect the destination, use browser privacy tools to view tracking parameters, and consider using a privacy-focused link shortener like Lunyb to strip unnecessary tracking from the links you share with others.

This article is general information, not legal advice. For specific situations, consult a qualified Canadian privacy lawyer.