Backgrounder: Government of Canada introduces legislation to Protect Canadians’ Privacy in the Digital Age

Today, the Government of Canada introduced Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), to amend the Personal Information Protection and Electronic Documents Act and to make consequential and related amendments to other Acts.

June 15, 2026 - Ottawa, Ontario

Today, the Government of Canada introduced Bill C-36, an Act to enact the Protecting Privacy and Consumer Data Act (PPCDA), to amend the Personal Information Protection and Electronic Documents Act and to make consequential and related amendments to other Acts.

The development and adoption of digital and data-driven technologies are creating major opportunities for Canada's economy. But they also raise new risks for Canadians' privacy, especially as artificial intelligence becomes more widely used. The PPCDA would modernize and strengthen Canada's private sector privacy law. As a key element in advancing Canada's National AI Strategy - AI for All, it is essential both to mitigate the risks associated with digital technologies - including AI - and to foster public trust in their use.

The proposed PPCDA represents the most significant change to Canada's private-sector privacy law in over 25 years. It builds on feedback received through continuous engagement with a wide variety of stakeholders since 2018, as well as parliamentary reports, and previous proposed legislation. The PPCDA will establish clear guardrails to protect Canadians' personal information in a rapidly changing digital world, with a particular focus on children's personal information, while supporting responsible innovation, a stronger economy, and Canada's digital and data sovereignty.

Enhancing Canadians' Privacy

The PPCDA will enhance protections for individuals by:

• recognizing privacy as a fundamental right;
• holding organizations to a higher standard when handling children's personal information;
• increasing control and transparency when Canadians' personal information is handled by organizations, including through meaningful consent and clearer explanations;
• increasing transparency around automated decision systems, including those powered by AI;
• enabling individuals to request deletion or disposal of their personal information in certain circumstances;
• supporting data mobility, so Canadians can move their information securely between organizations where a framework applies; and
• ensuring that personal information is used responsibly, transparently and for appropriate purposes, including to address unfair uses of personal information such as inappropriate surveillance pricing.

Supporting Responsible Innovation

The PPCDA will also foster innovation by:

• supporting responsible data use for innovation and socially beneficial purposes where privacy risks are explicitly assessed, addressed and effectively mitigated;
• supporting a proportionate approach to compliance, included by ensuring that the regulator takes into account the needs and challenges faced by small- and medium-sized businesses;
• providing clear rules for the use of privacy-enhancing technologies such as de-identification and anonymization, which will facilitate their use for the research and development of innovative goods and services;
• providing for co-regulatory mechanisms such as codes of practice and certification regimes to facilitate compliance with the law.

Protecting Canada's Digital Sovereignty

In an increasingly complex geopolitical context, the PPCDA would also promote Canada's data and digital sovereignty by:

• ensuring that organizations put in place appropriate security safeguards for personal information, and take into account potential privacy implications when using service providers;
• requiring that organizations assess and mitigate any privacy risks before sending personal information outside of Canada.

Strengthening Enforcement and Oversight

The protections established in the PPCDA will be backed by a strong enforcement regime:

• The new Digital Safety and Data Protection Commission of Canada (the Commission) will be responsible for administering the PPCDA. The Commission will also have responsibility for the Digital Safety Act. This dual mandate under the two Acts will support greater coherence across digital frameworks and enable the Commission to draw on the diverse expertise of its members. This is particularly important in addressing complex, cross-cutting privacy and digital safety issues, including age assurance, synthetic content and children's safety online.
• To ensure clear accountability for the PPCDA, a new designated Privacy and Consumer Data Commissioner will be appointed within the Commission to lead on oversight and enforcement of the PPCDA, supported by specialized privacy expertise.
• The Commission will have the ability to issue binding orders to make sure organizations comply with the law.
• The law will also include meaningful consequences for non-compliant organizations - administrative monetary penalties up to $10 million or 3% of global revenue, whichever is greater, and fines of up to $25 million or 5% of global revenue, whichever is greater, for the most serious offences.
• The Government will consult stakeholders to ensure a smooth and effective transition to the new regulator.

Finally, the Bill would establish part of the existing law that governs the use of electronic documents by the federal public sector as stand-alone legislation under the Electronic Documents Act.

Related Product

News Release: Government of Canada tables new legislation to protect children's data, strengthen privacy and build trust in the digital economy