Privacy Rights in Canada 2026: A Complete Guide for Individuals and Businesses

Canadian privacy law is at a turning point. With Bill C-27 reshaping the federal framework, Quebec's Law 25 already in full force, and new expectations from both the Office of the Privacy Commissioner (OPC) and global regulators, 2026 is the year Canadians and Canadian businesses need to pay close attention to privacy rights. This guide explains what rights you have, how they are enforced, and what organisations must do to stay compliant.

What Are Privacy Rights in Canada?

Privacy rights in Canada are the legal protections that control how governments and private organisations collect, use, disclose, and safeguard personal information about individuals. They stem from a mix of federal legislation, provincial statutes, the Canadian Charter of Rights and Freedoms, and common law traditions such as the tort of "intrusion upon seclusion."

At the federal level, two main laws apply:

• The Privacy Act — governs how federal government institutions handle personal information.
• PIPEDA (Personal Information Protection and Electronic Documents Act) — governs private-sector organisations engaged in commercial activities.

In 2026, these are being supplemented and in some cases replaced by modernised frameworks, most notably through Bill C-27, which introduces the Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA).

The 2026 Legal Landscape: Key Laws You Should Know

1. PIPEDA (Still the Baseline)

Until Bill C-27 is fully enacted and its transition periods expire, PIPEDA remains the primary federal privacy law for the private sector. It is built on ten fair information principles, including accountability, consent, limiting collection, accuracy, safeguards, and individual access.

2. Bill C-27 and the Consumer Privacy Protection Act (CPPA)

Bill C-27 proposes to repeal parts of PIPEDA and introduce the CPPA, which would:

1. Strengthen consent requirements and define "meaningful" consent more strictly.
2. Create a right to data mobility (portability) between organisations.
3. Introduce a right to request deletion of personal information.
4. Impose stronger obligations around algorithmic transparency when automated decisions significantly affect individuals.
5. Enable administrative monetary penalties of up to 3% of global revenue or CA$10 million, with fines of up to 5% of revenue or CA$25 million for the most serious offences.

3. The Artificial Intelligence and Data Act (AIDA)

AIDA, bundled within Bill C-27, targets "high-impact" AI systems. It requires risk assessments, mitigation measures, record-keeping, and transparency about how AI handles personal information — a direct response to growing concerns around profiling, facial recognition, and generative AI.

4. Provincial Privacy Laws

Several provinces have their own "substantially similar" private-sector laws:

• Quebec: Law 25 (formerly Bill 64) — arguably the strictest privacy regime in Canada, with mandatory privacy impact assessments, breach notification, and heavy fines.
• British Columbia: Personal Information Protection Act (PIPA BC).
• Alberta: Personal Information Protection Act (PIPA Alberta).
• Ontario, Nova Scotia, New Brunswick, Newfoundland and Labrador: Sector-specific health privacy laws such as PHIPA.

Your Core Privacy Rights as a Canadian in 2026

Whether you're dealing with a bank, an online retailer, a hospital, or a federal agency, Canadian law gives you a clear set of rights over your personal information.

1. The Right to Know

Organisations must tell you — in plain language — what personal information they collect, why, and how it will be used. Privacy policies must be accessible, understandable, and specific.

2. The Right to Consent

Consent must be meaningful. In 2026, regulators are especially focused on "dark patterns" — interface designs that nudge users into giving away more data than intended. Pre-ticked boxes, bundled consent, and confusing opt-outs are increasingly treated as non-compliant.

3. The Right of Access

You can request a copy of the personal information an organisation holds about you, along with information about how it has been used and to whom it has been disclosed.

4. The Right to Correction

If your information is inaccurate or incomplete, you can require the organisation to correct it.

5. The Right to Withdraw Consent and Request Deletion

You can withdraw consent subject to legal or contractual limitations. Under the CPPA, you will also have an explicit right to request that your data be disposed of — a meaningful upgrade over PIPEDA's more limited framework.

6. The Right to Data Portability

The CPPA introduces a right to have your personal information transferred from one organisation to another where a data mobility framework exists, starting with sectors like banking.

7. The Right to Challenge Compliance

If you believe an organisation has mishandled your data, you can complain to the OPC or the relevant provincial commissioner. In 2026, enforcement powers are significantly stronger than they were even a few years ago.

Federal vs. Provincial Privacy Laws at a Glance

Law	Who It Covers	Key 2026 Features	Maximum Penalties
PIPEDA (federal)	Private-sector commercial activity	10 fair information principles; breach reporting	Up to CA$100,000 per violation
CPPA (proposed, Bill C-27)	Private sector nationwide	Deletion, portability, algorithmic transparency	Up to 5% of global revenue or CA$25M
Quebec Law 25	Any org handling Quebec residents' data	Mandatory PIAs, DPO, strict cross-border rules	Up to 4% of worldwide turnover or CA$25M
PIPA BC / PIPA Alberta	Provincial private sector	Consent, access, breach notice	Up to CA$100,000
Privacy Act	Federal government institutions	Access, correction, limited collection	Primarily remedial, not punitive

How Canadians Can Exercise Their Privacy Rights

Knowing your rights is one thing — enforcing them is another. Here is a practical step-by-step approach for 2026.

1. Identify the organisation and jurisdiction. Determine whether the entity is federally regulated, provincially regulated, or a government body.
2. Submit a written request. For access, correction, or deletion, send a dated, written request. Most organisations have 30 days to respond under PIPEDA (with limited extensions).
3. Keep records. Save copies of your request, confirmations, and any responses.
4. Escalate internally. If you are unsatisfied, ask to speak with the Chief Privacy Officer or designated Privacy Officer.
5. File a complaint with the regulator. You can complain to the Office of the Privacy Commissioner of Canada or the applicable provincial commissioner.
6. Consider civil action. Canadian courts increasingly recognise tortious claims like intrusion upon seclusion and have certified several large privacy-related class actions.

What Businesses Must Do in 2026

For organisations operating in Canada, 2026 is a year to tighten governance and align with both existing and forthcoming rules.

1. Appoint and Empower a Privacy Officer

Every organisation subject to PIPEDA (and the CPPA) must designate a privacy officer. Under Quebec Law 25, this role is explicitly tied to the most senior person in the organisation unless responsibility is formally delegated in writing.

2. Conduct Privacy Impact Assessments (PIAs)

For high-risk processing — new AI systems, cross-border data transfers, biometric data, or large-scale profiling — PIAs are becoming the norm, not the exception.

3. Review Consent Mechanisms

Audit your cookie banners, sign-up flows, and marketing opt-ins. Remove dark patterns. Make consent granular, reversible, and clearly documented.

4. Harden Security Safeguards

Encryption in transit and at rest, access controls, logging, and vendor oversight are baseline expectations. Even seemingly simple tools — such as link shorteners used in marketing — should be chosen with privacy in mind. Services like Lunyb, which emphasise minimal data collection and secure link handling, can help reduce the amount of personal and behavioural data a business accumulates unnecessarily.

5. Prepare for Mandatory Breach Reporting

Under PIPEDA, organisations must report breaches of security safeguards involving a "real risk of significant harm" to the OPC and affected individuals. Quebec Law 25 imposes similar duties. In 2026, regulators expect:

• Documented breach response plans
• Internal breach registers (even for incidents not reported externally)
• Prompt notification, usually as soon as feasible

6. Update Vendor and Cross-Border Data Transfer Practices

Quebec Law 25 requires a privacy impact assessment before transferring personal information outside the province. The CPPA will formalise similar expectations federally. Contracts with service providers should include specific data protection clauses.

Online Privacy: Everyday Steps Canadians Should Take

Legal rights work best when combined with good personal practices. For 2026, consider:

• Use encrypted DNS (DoH or DoT) and privacy-respecting browsers.
• Enable two-factor authentication — ideally with an authenticator app or hardware key.
• Review app permissions on your phone quarterly.
• Choose privacy-first tools for messaging, email, and link sharing. For example, when sharing links on social media or in newsletters, a privacy-conscious shortener such as Lunyb avoids the heavy tracking baked into some alternatives.
• Regularly download and review the data copies social platforms and search engines hold about you.

Common Privacy Issues Canadians Face in 2026

1. AI and Automated Decision-Making

Credit scoring, hiring, insurance pricing, and fraud detection increasingly use AI. Canadians have growing rights to know when automated decisions are being made and to request explanations.

2. Biometric Data

Facial recognition and voiceprints are treated as sensitive personal information. Quebec in particular requires disclosure to the regulator before deploying biometric systems.

3. Children's Privacy

The CPPA explicitly recognises minors' information as sensitive, triggering heightened consent and safeguard expectations.

4. Cross-Border Data Flows

Between the US CLOUD Act, EU GDPR adequacy decisions, and evolving Canadian rules, organisations must document where data goes and how it is protected.

Enforcement Trends to Watch

Expect several enforcement themes to dominate 2026:

1. Bigger fines. The CPPA's monetary penalties and Quebec's enforcement tribunal will move Canada closer to GDPR-level consequences.
2. Joint investigations. The OPC and provincial commissioners increasingly coordinate on investigations, especially for national platforms.
3. AI-focused audits. Organisations using AI at scale will face more scrutiny on training data, bias, and transparency.
4. Class actions. Courts across Canada continue to expand privacy-related torts and certify class claims for large-scale breaches.

Key Takeaways

• Privacy rights in Canada in 2026 are stronger, clearer, and more enforceable than ever before.
• PIPEDA still applies, but the CPPA and AIDA under Bill C-27 are reshaping the federal regime.
• Quebec's Law 25 sets the current high-water mark, and other provinces are watching closely.
• Individuals should know their rights to access, correction, withdrawal of consent, and deletion — and use them.
• Businesses should invest in governance, PIAs, and privacy-by-design practices now, not after the first enforcement action.

FAQ

1. What is the main privacy law in Canada in 2026?

At the federal level, PIPEDA remains in force until the Consumer Privacy Protection Act (CPPA) under Bill C-27 fully takes effect. Several provinces, especially Quebec with Law 25, have their own comprehensive privacy regimes that apply in parallel.

2. Do I have a right to be forgotten in Canada?

Canada does not have a broad "right to be forgotten" like the EU, but under the CPPA, you will have an explicit right to request the disposal of personal information in many circumstances. You can already request deletion of inaccurate or unnecessary data under PIPEDA and Quebec Law 25.

3. How do I file a privacy complaint in Canada?

Start by contacting the organisation directly and asking for its Privacy Officer. If unresolved, file a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner. Complaints are generally free to file.

4. What are the penalties for violating Canadian privacy laws?

Current PIPEDA penalties are relatively modest, but Quebec Law 25 allows fines up to 4% of worldwide turnover or CA$25 million, and the proposed CPPA allows penalties of up to 5% of global revenue or CA$25 million for serious violations.

5. Does Canadian privacy law apply to foreign companies?

Yes. If a foreign organisation collects personal information from Canadians in the course of commercial activity — including through websites, apps, or online services — Canadian privacy laws can apply, and the OPC has asserted jurisdiction in several cross-border cases.