Privacy Map

Canada. Comprehensive data protection. Bill

Bill C-36 (PPCDA)Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act (PPCDA) and to make related amendments

Bill/proposed
Partly verifiedMedium confidence. Only at first reading (has NOT passed a chamber) - included at caller's request. LEGISinfo URL (45-1/c-36) constructed from parliament/session numbering, not opened.

§1Summary

Synopsis

Third attempt to modernise federal private-sector privacy law. It would replace Part 1 of PIPEDA with a new Act requiring privacy management programmes, PIAs in some cases, a disposal right, tighter rules for children's data and transparency for automated decision systems, enforced by a new commission with direct penalty powers.

Key themes
  • privacy management programme
  • disposal right
  • children's data
  • automated decision systems
  • cross-border risk assessment
  • AMPs
Unique features

Drops the tribunal model and the AI statute (AIDA) from C-27; merges privacy and online-safety oversight into one commission; requires assessing and mitigating risk before transferring data outside Canada.

SaaS relevance

If enacted, SaaS providers serving Canadians would face a GDPR-style compliance programme, transfer risk assessments and turnover-based penalties.

§2Obligations

Extraterritorial
Yes
Breach notification
Proposed: regulator and individuals (carried over RROSH model)
DPO
Yes
Cross-border transfers
Proposed: assess and mitigate risks before transfer outside Canada
Maximum penalty
Proposed: AMPs greater of CAD 10m or 3% gross global revenue; offences greater of CAD 25m or 5%

§3Dates

Key dates
  • Adopted
  • Tabled at first reading 2026-06-15 by the Minister of Artificial Intelligence and Digital Innovation; coming into force tied to Bill C-34 (Digital Safety Act) and a new regulator

§4Text and authority

Text
Authority
Proposed Digital Safety and Data Protection Commission of Canada

§5Where it applies

Domestic law of
Canada
Also applies in

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Only at first reading (has NOT passed a chamber) - included at caller's request. LEGISinfo URL (45-1/c-36) constructed from parliament/session numbering, not opened.