Privacy Rights in Canada 2026: A Complete Guide for Individuals and Businesses

Privacy rights in Canada have entered a new era in 2026. With evolving federal legislation, strengthened provincial frameworks, and growing public concern over how personal data is collected, used, and shared, both individuals and organisations need a clear understanding of where the law stands today. This guide walks you through the current landscape of Canadian privacy rights, what has changed, and how to exercise and protect those rights in practice.

What Are Privacy Rights in Canada?

Privacy rights in Canada are the legal protections that give individuals control over how their personal information is collected, used, disclosed, and retained by governments and private organisations. They are grounded in a combination of federal statutes, provincial laws, common law principles, and constitutional protections under the Canadian Charter of Rights and Freedoms.

In 2026, these rights span three broad categories: informational privacy (control over personal data), bodily privacy (protection from unwanted physical intrusion), and territorial privacy (protection in one's home or private spaces). This article focuses primarily on informational privacy, which is the area most affected by recent legislative reform and the digital economy.

The Core Federal Framework: PIPEDA and Beyond

The Personal Information Protection and Electronic Documents Act (PIPEDA) remains the cornerstone of private-sector privacy law in Canada in 2026. It applies to organisations that collect, use, or disclose personal information in the course of commercial activity across most of the country.

PIPEDA is built on ten Fair Information Principles, including accountability, consent, limiting collection, accuracy, safeguards, and individual access. These principles continue to shape how Canadian businesses must handle customer and employee data.

Bill C-27 and the Consumer Privacy Protection Act

The most significant development heading into 2026 has been the progression of Bill C-27, which proposes the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). When fully implemented, the CPPA will replace Parts 1 and 4 of PIPEDA and introduce:

1. Stronger consent requirements with plain-language explanations of data use.
2. A right to data mobility, allowing individuals to move their personal information between organisations.
3. A right to disposal, often described as a Canadian version of the "right to be forgotten."
4. Algorithmic transparency, requiring explanations when automated decisions significantly affect individuals.
5. Significantly higher penalties, with fines of up to 5% of global revenue or $25 million for serious violations.

Public Sector: The Privacy Act

The federal Privacy Act governs how federal government institutions handle personal information. Modernisation efforts continue in 2026, with proposed updates focused on breach notification, cross-border data transfers, and clearer rules for sharing information between departments and with foreign governments.

Provincial Privacy Laws You Should Know

Canada's privacy landscape is layered. Several provinces have their own private-sector privacy laws that have been declared substantially similar to PIPEDA, meaning they apply instead of the federal law for intra-provincial activity.

Jurisdiction	Primary Private-Sector Law	2026 Status
Quebec	Law 25 (formerly Bill 64)	Fully in force; strictest regime in Canada
British Columbia	Personal Information Protection Act (PIPA BC)	Under modernisation review
Alberta	Personal Information Protection Act (PIPA AB)	Reform consultations ongoing
Ontario	No general private-sector law; health sector covered by PHIPA	Public consultation on a provincial law
Federal (rest of Canada)	PIPEDA / forthcoming CPPA	In transition

Quebec's Law 25: The Benchmark

Quebec's Law 25 is the most comprehensive privacy regime in Canada in 2026. It introduced mandatory privacy officers, privacy impact assessments, breach notification, consent transparency, data portability, and the right to de-indexing. Organisations operating in Quebec, including those based elsewhere but serving Quebec residents, must meet these elevated standards.

Your Key Privacy Rights as a Canadian in 2026

Whether you deal with a federally regulated bank, a provincial retailer, or an online service, Canadian privacy law gives you a core set of rights that you can actively exercise.

1. The Right to Know

You have the right to be informed, in plain language, about what personal information an organisation collects, why it collects it, how long it will be kept, and who it will be shared with. Privacy policies must be accessible and understandable, not buried in legal jargon.

2. The Right to Consent

Consent must be meaningful. In 2026, this increasingly means affirmative, specific, and informed consent, especially for sensitive information such as health data, financial records, biometric identifiers, and children's information. Consent for secondary uses, such as marketing or analytics, must generally be separate from consent to receive the core service.

3. The Right to Access and Correction

You can request access to the personal information an organisation holds about you and ask for corrections if it is inaccurate. Organisations typically must respond within 30 days under PIPEDA and most provincial laws.

4. The Right to Withdraw Consent

You can withdraw consent at any time, subject to legal or contractual restrictions. If you close an account or opt out of a service, the organisation should stop using your information for the purposes you have withdrawn consent for.

5. The Right to Data Portability and Disposal

Under Quebec Law 25 and the proposed CPPA, individuals have the right to receive their data in a structured, commonly used format and to request deletion of information that is no longer necessary. This empowers Canadians to move between service providers and reduce their long-term digital footprint.

6. The Right to File a Complaint

If you believe your rights have been violated, you can file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the relevant provincial commissioner. In 2026, these offices have expanded investigatory powers and, in some cases, order-making authority.

Breach Notification Rules in 2026

Mandatory breach notification is now a well-established feature of Canadian privacy law. Under PIPEDA, organisations must report breaches of security safeguards involving personal information to the OPC and notify affected individuals if there is a real risk of significant harm (RROSH).

Significant harm includes bodily harm, humiliation, damage to reputation, financial loss, identity theft, and loss of employment or business opportunity. Organisations must also maintain breach records for at least 24 months, whether or not notification was required.

Quebec's Law 25 imposes similar obligations with its own confidentiality incident reporting rules, and the forthcoming CPPA will harmonise and strengthen these requirements federally.

Cross-Border Data Transfers

Many Canadian organisations use cloud services, payment processors, or marketing platforms based outside Canada. Canadian privacy law does not prohibit cross-border transfers, but it requires organisations to use contractual or other means to ensure a comparable level of protection, and to be transparent with individuals about where their data may be processed.

In 2026, regulators are paying closer attention to transfers to jurisdictions with broad government access powers. Expect more detailed disclosures in privacy notices about data residency and sub-processors.

Workplace Privacy

Employee privacy is a growing area of focus. In federally regulated workplaces and in BC, Alberta, and Quebec, specific laws govern how employers can collect and use employee information. Common issues in 2026 include:

• Monitoring of remote and hybrid workers.
• Use of productivity tracking software and keystroke loggers.
• Video surveillance in the workplace.
• Collection of biometric data for access control.
• Background checks and social media screening.

Employers should have clear, written policies, provide notice of monitoring, and ensure that any collection is reasonable, proportionate, and necessary for a legitimate business purpose.

Children's and Youth Privacy

Protecting minors online is a legislative priority. The proposed CPPA designates information about minors as sensitive by default, requiring heightened safeguards and generally stronger consent standards. Quebec already prohibits the use of profiling, geolocation, and identification technologies on minors under 14 without parental consent, and requires default privacy settings for all minors.

How to Protect Your Privacy in Practice

Legal rights are only part of the picture. In 2026, Canadians can take concrete steps to protect their personal information in daily digital life.

1. Minimise What You Share

Only provide the information required to receive a service. Treat requests for your date of birth, phone number, or home address with the same scrutiny you would apply to financial details.

2. Review Privacy Settings Regularly

Social platforms, operating systems, and smart devices update their settings frequently. Set a reminder to audit the privacy and ad personalisation settings on your most-used services at least twice a year.

3. Use Privacy-Respecting Tools

Choose browsers with strong default protections, enable encrypted DNS, use a reputable password manager, and turn on multi-factor authentication. When sharing links, consider a privacy-conscious URL shortener such as Lunyb, which lets you share short, trackable links without exposing unnecessary information in the original URL. You can read an independent breakdown in our honest review of Lunyb or compare options in our 2026 URL shortener buyer's guide.

4. Exercise Your Rights

Submit access requests to organisations that hold significant data about you, such as your bank, telecom provider, or primary online retailer. Reviewing what they hold often reveals opportunities to request corrections or deletion.

5. Report Problems

If an organisation refuses to respond, misuses your data, or suffers a breach that affects you, file a complaint with the OPC or your provincial commissioner. Regulators rely on individual complaints to identify systemic issues.

What Businesses Should Do in 2026

Organisations operating in Canada should treat 2026 as a year of alignment. Even if the CPPA has not fully taken effect in your jurisdiction, aligning with its principles now reduces future compliance costs and builds customer trust.

1. Appoint a privacy officer and document their mandate.
2. Map your data flows, including sub-processors and cross-border transfers.
3. Conduct privacy impact assessments for new projects involving personal information.
4. Update privacy policies in plain language, with clear information about automated decision-making.
5. Train staff on consent, access requests, and breach response.
6. Review marketing practices, including analytics, cookies, and link tracking, for lawful basis and transparency.

For marketing teams relying on branded links and campaign analytics, platforms like Rebrandly and Lunyb can help balance measurement with respect for user privacy by offering transparent, auditable link tracking rather than opaque third-party pixels.

The Road Ahead

Canadian privacy law in 2026 is in a period of modernisation that will likely continue through the rest of the decade. Expect further harmonisation between federal and provincial regimes, stronger enforcement, and more detailed rules around artificial intelligence, biometric data, and children's online safety. Individuals who understand their rights and organisations that embed privacy into their operations will be best positioned to thrive in this environment.

Frequently Asked Questions

Is PIPEDA still in effect in 2026?

Yes. PIPEDA remains the primary federal private-sector privacy law in Canada in 2026. The proposed Consumer Privacy Protection Act under Bill C-27 is intended to replace parts of it, but until it is fully enacted and in force, PIPEDA continues to apply.

Do I have a "right to be forgotten" in Canada?

Canada does not have a right to be forgotten identical to the European model, but Quebec's Law 25 provides a right to de-indexing in certain circumstances, and the proposed CPPA includes a right to disposal of personal information when it is no longer necessary or when consent is withdrawn.

How do I file a privacy complaint in Canada?

You can file a complaint with the Office of the Privacy Commissioner of Canada for federally regulated organisations, or with your provincial privacy commissioner (such as the CAI in Quebec, OIPC in BC or Alberta, or IPC in Ontario for health and public-sector matters). Most offer online complaint forms and require you to first attempt to resolve the issue directly with the organisation.

What is the maximum fine for a privacy violation in Canada?

Under current PIPEDA provisions, fines are limited, but Quebec's Law 25 already allows administrative penalties up to $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%. The proposed CPPA would introduce comparable penalties federally, with fines of up to $25 million or 5% of global revenue for the most serious violations.

Do Canadian privacy laws apply to foreign companies?

Yes, when there is a real and substantial connection to Canada. A foreign company that collects personal information from Canadians through a website, app, or service directed at the Canadian market is generally subject to PIPEDA and, where applicable, provincial privacy laws.