Protecting Privacy and Consumer Data Act (Bill C-36)

Bill — not yet law Canada

Introduced but not enacted. It can be amended beyond recognition or die on the order paper, and nothing in it binds anyone today. Catalogued because the obligations it proposes are the ones worth building toward.

Bill C-36 is Canada’s third run at replacing PIPEDA, and the history matters more than the text. Bill C-11 died in 2020. Bill C-27 — which paired privacy reform with the Artificial Intelligence and Data Act — died when Parliament was prorogued on 6 January 2025, taking AIDA with it. C-36 was tabled on 15 June 2026 and is at first reading.

What it proposes:

• Replace PIPEDA for federal private-sector privacy - A modern consent framework, with defined exceptions for legitimate business activities.
• A new regulator - The Digital Safety and Data Protection Commission of Canada, with order-making power, replacing a Privacy Commissioner who has spent two decades able to recommend but not compel.
• Administrative monetary penalties with real magnitude - Up to the greater of CAD 10 million or 3% of gross global revenue, and for certain offences the greater of CAD 25 million or 5%.
• Children’s data as a distinct category - The framing the government led with publicly.
• Automated decision system provisions - Transparency and explanation duties, arriving through the privacy statute rather than a standalone AI law.

That last point is the one I would flag hardest, because it is routinely misread in both directions. Canada has no AI act, and C-36 is not one. AIDA is gone and has not been revived; the government’s June 2026 “AI for All” strategy is policy, not legislation. What actually governs AI in Canada today is PIPEDA, Quebec’s Law 25 — which has had binding automated-decision transparency and explanation rights in force since 2023 and is the strictest regime in the country — provincial private-sector acts in Alberta and BC, sectoral regulators, and the Treasury Board Directive on Automated Decision-Making, which binds federal government systems and not the private sector at all.

So the honest picture for a company operating in Canada is: comply with Quebec, and you have largely complied with the rest. Quebec’s Law 25 has been the real Canadian privacy regime since 2023, and it got there while three successive federal bills failed.

The reason to carry C-36 in the catalog despite its status is the enforcement change. Canadian privacy compliance has been shaped, for twenty years, by the fact that the federal regulator could not impose a penalty. Every conversation about Canadian data protection has quietly priced that in. An order-making commission with 5%-of-global-revenue authority would re-price it — and companies that have been treating PIPEDA as a soft obligation because it has always been one would be recalibrating against a regime with more enforcement headroom than the GDPR’s headline figure.

Two prior bills died. This one may. But the direction of travel across all five jurisdictions in this catalog has been one-way, and nobody has ever replaced a data-protection regulator with a weaker one.