An Overview of Bill C-36: Canada's Newly Introduced Private-Sector Privacy Law

On June 15, 2026, Canada’s federal government introduced Bill C‑36, the Protecting Privacy and Consumer Data Act (“PPCDA”).

The bill proposes to replace Part 1 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) — Canada’s existing private sector privacy law that has governed the collection, use, and disclosure of personal information since 2001.

Bill C‑36 is Canada’s third attempt at private-sector privacy reform, following Bill C‑11 (introduced in 2020 and died in 2021), and Bill C‑27 (introduced in 2022 and died in 2025).

The new bill is currently in its first reading, which is the earliest stage of the legislative process.

Below we walk through our perspectives on the bill, some key differences from C‑27 and the current PIPEDA, and what to watch for next:

• Introduction of a new Regulator — oversight of the law would shift to the Digital Safety and Data Protection Commission of Canada — an expansion of a commission created under separate digital-safety legislation, with the Office of the Privacy Commissioner’s role folded in. A new regulator means new (and unknown) expectations, guidance, and enforcement.

• C‑36 doesn’t stand on its own — the bill’s privacy obligations can’t come into force until the new regulator (the Digital Safety and Data Protection Commission of Canada) is up and running, and that Commission depends on the passage of a separate bill, Bill C‑34 (the Safe Social Media Act). This means that even if C‑36 passes through Parliament quickly, its coming-into-force is tied to the fate of another piece of legislation.

• Stronger enforcement and stiffer penalties — consistent with what was proposed under Bill C‑27, the PPCDA brings order-making powers, significant administrative monetary penalties, and an expanded private right of action.

• A focus on AI regulation - Rather than a separate/​standalone AI law (the route Bill C‑27 took with its Artificial Intelligence and Data Act for ​“hight-impact” systems), Bill C‑36 addresses AI risk through privacy rules. It strengthens rights around automated decision-making, including a right to explanation and human review for decisions with a ​“legal or similarly significant effect,” language drawn directly from the General Data Protection Regulation (GDPR).

• A formal definition of ​“sensitive” personal information — the bill introduces the concept of ​“sensitive” personal information (information for which an individual has a heightened expectation of privacy over), expressly including a child’s personal information, or personal information pertaining to an individual’s racial or ethnic origin, political opinions, sexual orientation, health and biometric data, etc. This definition aligns with the approach long taken in the EU’s GDPR, which give ​“special category” data extra protection. The signal for Canadian organizations is a shift toward tiered, risk-based handling, and an emphasis that not all personal information is treated the same.

• A slight shift in consent — Consent remains the default basis for handling personal information, but C‑36 makes the rules more prescriptive than those currently in PIPEDA. Valid consent will require plain-language disclosure of the purposes, the type of information, the reasonably foreseeable consequences, and any third-party recipients, and consent obtained through false or misleading means is explicitly invalid. At the same time, the bill carves out new expectations where consent isn’t needed at all; a ​“business activities” (yet to be prescribed in regulation) exception for expected operational uses and a GDPR-style ​“legitimate interest” ground that will allow organizations to proceed without consent where their interest outweighs any reasonably foreseeable adverse effect on the individual. The net effect is a régime that demands more rigour where consent is used, while reducing reliance on consent for routine processing.

• New rights introduced - Bill C‑36 introduces several rights that go beyond PIPEDA’s current access-and-correction model, and that seem to align to Quebec and EU laws. These include rights such as (1) data mobility — on request, organizations must transfer an individual’s personal information to another designated organization, subject to Regulation; (2) data deletion — individuals can request that an organization permanently and irreversibly delete or anonymize their personal information, subject to certain exceptions; and (3) Cross-border transfers — before disclosing or transferring personal information outside Canada, organizations must conduct a privacy impact assessment.

What’s next?

It’s still early. Bill C‑36 is only in first reading and must still pass second reading, committee study (where amendments are likely), third reading, Senate/​House process, and royal assent before becoming law, so while we don’t see the new requirements coming into effect anytime soon, it’s always best to keep an eye on things to understand where law makers and regulators might be heading.

This article offers a first glimpse at Bill C‑36 and the changes ahead. At Mara, we help organizations across the public and private sectors make sense of evolving privacy requirements (from privacy management programs and gap assessments to consent, cross-border transfers, and vendor oversight). For this, and all other privacy management program needs, we can help your organization understand what’s required and prepare with confidence!