Bill C-36 (Protecting Privacy and Consumer Data Act)
Also known as: Bill C-36, Protecting Privacy and Consumer Data Act, PPCDA, Canadian federal privacy reform, PIPEDA replacement
Bill C-36, the Protecting Privacy and Consumer Data Act, is the federal government's proposed replacement for the privacy rules in PIPEDA, Canada's main private-sector privacy law.
While Ottawa has promised modern privacy law for years, this is its third attempt, after two earlier bills died when Parliament ended. As of late 2026 it was still a bill, not law, so businesses should treat it as a direction of travel rather than a set of obligations.
Bill C-36 (Protecting Privacy and Consumer Data Act), explained at three levels
At home
Think of PIPEDA as a rulebook written in 2000, before smartphones, cloud apps, and data brokers. Bill C-36 is Ottawa's proposed rewrite of that rulebook. It would replace PIPEDA's privacy rules with a new law covering how businesses collect, use, and share your information, backed by stronger penalties and a new regulator. Until Parliament passes it and it takes effect, the old rulebook still applies.
At work
Bill C-36, the Protecting Privacy and Consumer Data Act, is a federal bill tabled in June 2026 to replace the privacy part of PIPEDA. It would update rules on consent, de-identified data, transfers outside Canada, and enforcement. Businesses care because it would bring larger penalties and a regulator that can issue orders. As of late 2026 it is still a bill, so current obligations come from PIPEDA and provincial laws.
At home
The bill is built around a few core ideas. It would state that privacy is a fundamental right, which shapes how courts read the rest of the law. It would separate 'de-identified' data, which could still be linked back to you and stays personal, from 'anonymized' data, which no longer identifies anyone and falls outside the law. It would also treat information about children as deserving extra protection, limiting how companies can use it.
At work
Structurally, C-36 would enact a standalone privacy statute and repeal Part 1 of PIPEDA, the part that governs private-sector privacy. The core duties look familiar: identify purposes, obtain valid consent or rely on a listed exception, limit retention, safeguard data, and answer access requests. What changes is the machinery around them, including rules for de-identification, assessments before transferring data outside Canada, and order-making and penalty powers held by a new commissioner instead of today's recommendation-based model.
At home
The real fight is over exceptions. Consent is the law's main safeguard, but the bill, like C-27 before it, lists situations where businesses could skip consent, such as certain business activities and legitimate interests, and would let them use de-identified data more freely for internal purposes. Critics say those exceptions are wide enough to swallow the rule. While supporters argue they reflect how modern services work, in my opinion the definitions of de-identified and anonymized data are where real protection will be won or lost.
At work
The bill would create the Digital Safety and Data Protection Commission of Canada, with a Privacy and Consumer Data Commissioner inside it taking over the private-sector role of the Office of the Privacy Commissioner. That body could investigate, issue orders, and impose penalties, a shift from today's mostly recommendation-based model. Oversight changes matter beyond Canada, because the EU reviews adequacy partly on independent supervision. Since C-27 changed substantially in committee before it died, compliance teams should track amendments rather than the tabled text.
Real-world examples
At home
Carlos read a headline saying Canada had a 'new privacy law' and assumed his rights had changed. When he looked closer, he realized Bill C-36 had only been introduced. Until Parliament passes it, PIPEDA still governs how most companies handle his information.
At work
Lena is the privacy officer at a Calgary software firm. Rather than rewriting policies for every version of federal reform, she aligned the company's program with Quebec's Law 25 and GDPR principles. When Bill C-36 was tabled, she found the company already met most of its proposed requirements.
Common confusions
- Bill C-36 is now Canada's privacy law. — A bill isn't law until it passes Parliament and takes effect. PIPEDA and provincial laws still apply.
- Bill C-36 is the same as Bill C-27. — It carries forward many privacy ideas from C-27, but it drops the Artificial Intelligence and Data Act and changes oversight arrangements.
- Anonymized and de-identified data mean the same thing. — The bill treats them differently. De-identified data is still personal information; anonymized data generally is not.
For analysts
Don't wait for federal reform to pass before improving privacy practices. I'd build to the strictest rules you already face (Law 25 or GDPR), then adjust when Ottawa finally delivers. Two dead bills in a row tell you the timeline is unreliable.
History & origin
The first attempt, Bill C-11 (the Digital Charter Implementation Act, 2020), was tabled in November 2020 and died when the 2021 federal election was called. Its successor, Bill C-27, introduced in June 2022, proposed a Consumer Privacy Protection Act, a new tribunal, and an Artificial Intelligence and Data Act. It spent years in committee and died when Parliament was prorogued in January 2025. On June 15, 2026, the government tabled Bill C-36, which carries forward privacy reforms but drops the AI act. Early legal commentary highlighted its proposal to repeal PIPEDA's privacy provisions, entrench a fundamental right to privacy, distinguish de-identified from anonymized data, require assessments before transferring data outside Canada, and move oversight to a new commission rather than the Office of the Privacy Commissioner. Civil liberties groups criticized parts of it. Having watched two bills die already, I'd say the history suggests caution: Canadian privacy reform has a habit of running out of parliamentary time.