Canada's privacy law in 2026: Bill C-27 is gone, Bill C-36 is new, and PIPEDA still applies

Founders have heard for years that Canada’s federal privacy law is about to be replaced. It hasn’t been yet. Here’s where things stand, and what that means for a startup building its privacy program now.

This post is general information, not legal advice.

What happened to Bill C-27

Bill C-27 would have replaced the private sector part of PIPEDA with a Consumer Privacy Protection Act, created a privacy tribunal and enacted the Artificial Intelligence and Data Act. It was still in committee when Parliament was prorogued on January 6, 2025, and it died (LEGISinfo). None of it became law.

Bill C-36

On June 15, 2026, the federal government introduced Bill C-36, which would enact the Protecting Privacy and Consumer Data Act. It’s the third federal attempt since 2020 to modernize private sector privacy law. As introduced, published summaries describe it as including:

• a new Digital Safety and Data Protection Commission of Canada (built on the Digital Safety Commission proposed in Bill C-34), which would take over the Privacy Commissioner of Canada’s private sector responsibilities, with one of its members designated as a Privacy and Consumer Data Commissioner to investigate complaints and run audits (the Privacy Commissioner’s statement on the bill);
• administrative penalties of up to the greater of $10 million or 3% of gross global revenue, and fines for some offences of up to the greater of $25 million or 5%;
• rules on de-identified and anonymized information;
• explanations, on request, of automated decisions that have significant effects on individuals;
• a private right of action.

Bill C-36 had first reading on June 15, 2026, and as of late October 2026 LEGISinfo still showed it awaiting second reading in the House of Commons. It has to pass the House of Commons and the Senate, can change along the way, and would come into force on dates that aren’t yet set. Nothing in it is a current obligation. Follow its progress on LEGISinfo.

What applies today

PIPEDA applies to private sector organizations that collect, use or disclose personal information in the course of commercial activity, except in provinces with substantially similar laws for activity within those provinces. Its core requirements are familiar:

• be accountable, with someone responsible for privacy;
• identify your purposes before or when you collect;
• get meaningful consent, express where the information is sensitive or the use is outside what people would reasonably expect;
• limit collection, use and retention to what you need;
• protect information with safeguards suited to its sensitivity;
• be open about your practices in a privacy policy people can understand;
• give people access to their information.

Since November 2018, PIPEDA has also required organizations to report a breach of security safeguards that creates a real risk of significant harm to the Commissioner and affected individuals, and to keep records of all breaches.

Provincial laws apply alongside it. Quebec’s private sector law, amended by Law 25, goes furthest. British Columbia and Alberta have their own private sector statutes. Ontario’s PHIPA governs personal health information held by health information custodians and their agents.

What this means for a startup

Waiting for the new law isn’t a strategy. The fundamentals that PIPEDA requires today, knowing what you collect, why, where it goes and how long you keep it, are the same work any successor will need. Practical steps:

• Map your data: what you collect, from whom, where it’s stored and which vendors receive it.
• Write a privacy policy that matches what your product actually does. See privacy policies for apps.
• Put a data processing agreement in place with business customers and vendors.
• Set up a breach response plan and breach record.
• If you have Quebec users, address Law 25’s additional requirements.
• If your product makes automated decisions about people, document how, since both Quebec law and Bill C-36 point toward explaining them.

Enterprise customers ask about all of this in procurement, whether or not a new law passes. See SaaS agreements.

We prepare privacy policies and SaaS agreements at fixed fees, listed on our fees page. If you’d like to check your privacy setup, book a free 15-minute consult.