Canadian Government Introduces Major Reform For Federal Privacy Law

On June 15, 2026, Canada took a major step towards overhauling its federal privacy legislation with the tabling of Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts (Bill C-36). Bill C-36 proposes to modernize Canda’s private sector privacy framework through introducing, among other things, (i) a new privacy law that replaces key provisions of the present federal private sector law; (ii) a new regulator to oversee compliance; and (iii) more obligations for regulated entities. Bill C-36 is currently at its second reading in the House of Commons.

Canada’s current private sector privacy law is more than 25 years old and predates many of today’s digital realities, including large scale artificial intelligence systems and the widespread collection of children’s personal information online. Bill C-36 will introduce  the Protecting Privacy and Consumer Data Act (PPCDA), which aims to establish more guardrails to protect Canadian’s personal information, with a particular focus on children’s privacy, while providing organizations with clearer rules to support responsible innovation and maintain public trust.

Among other measures, the PPCDA would:

• introduce enhanced protections for children’s personal information;
• strengthen consent and transparency requirements for the use of personal information;
• establish obligations relating to the use of automated decision-making systems;
• require organizations to delete personal information upon request in certain circumstances,
• provide a framework for the use of privacy enhancing processes, such as the de-identification and anonymization of personal information; and
• strengthen data sovereignty by requiring organizations to implement robust privacy safeguards and conduct risk assessments before transferring personal information outside Canada.

The PPCDA would also fall under the regulatory oversight of a new Digital Safety and Data Protection Commission of Canada, which has the power to issue binding orders and administrative monetary penalties for non-compliance. Organizations that contravene the PPCDA could face penalties up to $10 million or 3% of global revenue, whichever is greater, and fines of up to $25 million or 5% of global revenue, whichever is greater, for the most serious offences.

For more details, see the full text of Bill C-36 available here.

DWW intends to continue monitoring the progress of Bill C-36 and provide updated information in the coming months, including in-depth reviews of key aspects of the bill. Stay tuned!

Summary By: Victoria Di Felice