Privacy Rights in Canada 2026: A Complete Guide for Individuals and Businesses

Canadian privacy law has evolved rapidly over the past few years, and 2026 marks a pivotal moment for both individuals and organisations. With the ongoing modernisation of federal privacy legislation, new enforcement powers for regulators, and expanded obligations around artificial intelligence, understanding your privacy rights in Canada has never been more important. This guide breaks down the current landscape, what has changed, and what you can do to protect your personal information.

What Are Privacy Rights in Canada?

Privacy rights in Canada refer to the legal protections individuals have over their personal information, including how it is collected, used, disclosed, stored, and disposed of by both government bodies and private organisations. These rights are grounded in a combination of federal statutes, provincial laws, and constitutional principles under the Canadian Charter of Rights and Freedoms.

At the federal level, two main laws govern privacy: the Privacy Act, which applies to federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which applies to private-sector organisations engaged in commercial activity. Provincial legislation such as Quebec's Law 25, Alberta's PIPA, and British Columbia's PIPA may apply instead of PIPEDA within those provinces.

The Legal Framework in 2026

The Canadian privacy landscape in 2026 is shaped by a layered framework of federal and provincial laws, each with its own scope and requirements. Understanding which law applies to a specific situation is often the first step in asserting your rights.

Federal Laws

• Privacy Act — Governs how federal institutions collect, use, and disclose personal information.
• PIPEDA — Applies to private-sector organisations handling personal information during commercial activities, as well as to interprovincial and international data transfers.
• Bill C-27 (Digital Charter Implementation Act) — Proposes to replace PIPEDA with the Consumer Privacy Protection Act (CPPA), introduce the Personal Information and Data Protection Tribunal Act, and enact the Artificial Intelligence and Data Act (AIDA).

Provincial Laws

• Quebec — Law 25: Fully in force since 2024, with the strongest consent, transparency, and automated decision-making rules in Canada.
• Alberta — PIPA: Private-sector law substantially similar to PIPEDA, currently under modernisation review.
• British Columbia — PIPA: Similar in scope to Alberta's PIPA with its own breach notification rules.
• Ontario: Governed by sector-specific laws such as PHIPA for health information; a general private-sector law has been debated but not enacted.

Core Privacy Rights Every Canadian Has in 2026

Regardless of which law applies, Canadians share a common core of rights designed to give them meaningful control over their personal information.

1. The Right to Know

Organisations must inform you about what personal information they collect, why they are collecting it, how it will be used, and with whom it will be shared. Privacy policies must be accessible and written in plain language.

2. The Right to Consent

Meaningful consent is a cornerstone of Canadian privacy law. In 2026, consent must be clear, specific, and informed. Quebec's Law 25 and the proposed CPPA push this further by requiring granular consent for secondary uses and explicit consent for sensitive data such as biometrics.

3. The Right to Access

You can request a copy of the personal information an organisation holds about you, usually within 30 days and free of charge or for a minimal fee.

4. The Right to Correction

If information held about you is inaccurate or incomplete, you have the right to request a correction. Organisations must either make the change or note the dispute in the file.

5. The Right to Withdraw Consent

Consent is not permanent. You can withdraw it at any time, subject to legal or contractual restrictions, and the organisation must inform you of the consequences of withdrawal.

6. The Right to Data Portability

A newer right emerging under Bill C-27 and already present under Quebec's Law 25, data portability allows you to request your personal information in a structured, commonly used technological format, enabling you to move it to another service.

7. The Right to Disposal (Right to be Forgotten)

Canadians can request that organisations delete personal information that is no longer necessary or was collected without proper authority. Quebec led the way on this, and the CPPA proposes a similar federal right.

8. The Right to Challenge Automated Decisions

When significant decisions about you are made exclusively by automated systems, you have the right to be informed, request an explanation, and in some cases ask for human review.

Key Changes to Watch in 2026

Several legislative and regulatory developments are reshaping Canadian privacy practice this year. Here are the most consequential ones.

Bill C-27 Progress

Bill C-27 continues to shape the direction of federal privacy reform. If enacted, the CPPA would replace PIPEDA with stronger penalties — up to 5% of global revenue or $25 million CAD for the most serious violations — and would create a dedicated tribunal to review decisions by the Office of the Privacy Commissioner (OPC).

Artificial Intelligence and Data Act (AIDA)

AIDA would be Canada's first dedicated AI law, imposing obligations on organisations that design, develop, or deploy high-impact AI systems. Expected requirements include risk assessments, mitigation measures, transparency obligations, and record-keeping.

Expanded Enforcement

The OPC has signalled a more assertive posture, including joint investigations with provincial regulators and international partners. Expect more public findings against large platforms and increased scrutiny of cross-border data transfers.

Children's Privacy

Both federal and Quebec regulators are focused on protecting minors online. Expect new guidance on age-appropriate design, limits on behavioural advertising to children, and stricter consent rules for processing minors' data.

Comparing Canadian Privacy Laws

The following table summarises how major Canadian privacy regimes compare in 2026.

Feature	PIPEDA (Federal)	Quebec Law 25	Proposed CPPA
Maximum fines	Up to $100,000 CAD	Up to $25M or 4% global revenue	Up to $25M or 5% global revenue
Right to deletion	Limited	Yes	Yes
Data portability	No	Yes	Yes
Mandatory breach reporting	Yes	Yes	Yes
Privacy impact assessments	Recommended	Mandatory for certain projects	Mandatory for high-risk activities
Dedicated tribunal	No	No	Yes

What Businesses Need to Do

Organisations operating in Canada should treat 2026 as a compliance acceleration year. Here is a practical roadmap.

1. Map your data — Document what personal information you collect, where it is stored, who has access, and how long it is retained.
2. Appoint a privacy officer — Required under PIPEDA and Quebec Law 25, and expected under the CPPA.
3. Update privacy policies — Use plain language, disclose automated decision-making, and specify international transfers.
4. Conduct privacy impact assessments — Especially for new technologies, AI systems, or significant data-sharing initiatives.
5. Implement a breach response plan — Define thresholds for "real risk of significant harm" and workflows for notifying the OPC and affected individuals.
6. Review vendor contracts — Ensure processors offer equivalent protections, especially for cross-border transfers.
7. Train staff regularly — Human error remains the leading cause of breaches.

How Individuals Can Protect Their Privacy

Legal rights are only meaningful if you exercise them. Here are practical steps Canadians can take in 2026 to protect their personal information online and offline.

Online Habits

• Review the permissions on your mobile apps monthly and revoke anything unnecessary.
• Use a privacy-focused browser and enable encrypted DNS (DNS over HTTPS) to prevent your internet provider from logging the sites you visit.
• Enable multi-factor authentication on email, banking, and social media accounts.
• Prefer messaging apps that offer end-to-end encryption by default.
• When sharing links publicly, consider using a trustworthy shortener such as Lunyb that respects user privacy and does not track recipients across the web. For a deeper look, see our honest Lunyb review.

Exercising Your Rights

1. Identify the organisation and the law that applies (federal vs provincial).
2. Submit a written access, correction, or deletion request to the organisation's privacy officer.
3. Allow 30 days for a response.
4. If the response is unsatisfactory, file a complaint with the OPC or the relevant provincial commissioner.
5. Consider recourse through the courts for damages, if applicable.

Managing Shared Links and Marketing

Marketers and content creators have specific obligations under Canada's Anti-Spam Legislation (CASL) as well as privacy law. If you distribute links, campaigns, or newsletters, choose tools that offer transparent analytics without excessive tracking of recipients. For a comparison of options, our 2026 URL shortener buyer's guide walks through the privacy posture of major providers, and our Rebrandly review looks at one of the better-known commercial options.

Cross-Border Data Transfers

Transferring personal information outside Canada remains legal, but the OPC and Quebec's CAI both require organisations to assess whether the destination offers comparable protection. In 2026, expect increased scrutiny of transfers to jurisdictions with broad government access regimes. Contractual safeguards, encryption in transit and at rest, and transparency to users about where data is stored are now baseline expectations.

Enforcement Trends and Penalties

Enforcement has become more muscular. Quebec's CAI can already issue administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and recommend higher penal fines. The OPC continues to publish detailed findings naming organisations, and class actions for privacy breaches are increasingly common in Canadian courts. Statutory damages for intrusion upon seclusion and public disclosure of private facts have been recognised in several provinces.

Sector-Specific Considerations

Some sectors face additional obligations in 2026.

• Health care: Provincial statutes such as Ontario's PHIPA, Alberta's HIA, and Quebec's health information law impose strict rules on custodians.
• Financial services: Open banking frameworks introduce new consent and portability rules.
• Education: Public bodies are subject to provincial access-to-information and privacy laws such as Ontario's FIPPA.
• Employment: Workplace surveillance disclosure is now mandatory in Ontario for employers with 25 or more workers.

Frequently Asked Questions

Does PIPEDA apply to my small business in Canada?

PIPEDA applies to any organisation that collects, uses, or discloses personal information in the course of commercial activity, regardless of size. However, in Alberta, British Columbia, and Quebec, substantially similar provincial laws apply instead within those provinces. Even very small businesses handling customer data must comply with the applicable regime, including appointing a privacy officer and responding to access requests.

What should I do if a Canadian company refuses to delete my data?

First, submit the request in writing to the company's designated privacy officer and keep a record. If the organisation refuses or does not respond within 30 days, you can file a complaint with the Office of the Privacy Commissioner of Canada, or with your provincial commissioner if you live in Quebec, Alberta, or British Columbia. The commissioner will investigate and can issue findings or, in Quebec, administrative penalties.

Is Bill C-27 the law in 2026?

Bill C-27 has been working its way through Parliament for several years. Depending on the parliamentary calendar and any amendments, portions of it may be in force in 2026 while others may remain pending. Organisations should monitor its progress closely and begin preparing for the stricter CPPA and AIDA requirements regardless of the exact timeline, since Quebec Law 25 already imposes many of the same obligations.

How are AI systems regulated under Canadian privacy law?

At present, AI systems that process personal information are subject to general privacy laws, including requirements for consent, transparency, and accountability. Quebec Law 25 already requires organisations to inform individuals when a decision is made exclusively by automated processing and to explain the main factors. The proposed AIDA would layer additional obligations on high-impact AI systems, including risk assessments and mitigation measures.

What counts as a reportable privacy breach in Canada?

Under PIPEDA, organisations must report breaches to the OPC and notify affected individuals if the breach creates a "real risk of significant harm," which includes bodily harm, humiliation, damage to reputation, loss of employment, financial loss, or identity theft. Factors include the sensitivity of the information and the probability of misuse. Provincial laws, particularly Quebec's, have broadly similar but not identical thresholds, so cross-jurisdictional incidents require careful analysis.

Final Thoughts

Privacy rights in Canada are stronger and more actively enforced in 2026 than at any point in the country's history. For individuals, this means more tools to control personal information and more accessible paths to recourse. For organisations, it means that privacy can no longer be treated as a compliance afterthought — it is a core governance issue with meaningful financial and reputational consequences. Whether you are an individual exercising your rights or a business building a modern privacy programme, now is the time to understand the law and act on it.