Canada Bill C-36 (PPCDA)
Proposed Canada ยท no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.
- Who it applies to
- Organisations handling personal information in the course of commercial activity (as under PIPEDA).
- Penalties
- As tabled: administrative monetary penalties up to the greater of CAD 10 million and 3% of global revenue; criminal fines up to the greater of CAD 25 million and 5% of global revenue on indictment.
- Enforced by
- Digital Safety and Data Protection Commission of Canada (proposed)
- Official name
- Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act
- Citation
- Bill C-36 (45th Parliament, 1st Session)
- Topics
- privacy, breach-notification
Research notes
Penalty figures are from law-firm/IAPP summaries of the first-reading text. No federal AI successor to AIDA has been tabled as of Aug 2026.
Related
Brazil ECA Digital
Canada Bill C-8 / CCSPA
Quebec Law 25Questions about Canada Bill C-36 (PPCDA)
- What are the Canada Bill C-36 (PPCDA) compliance deadlines?
- Jun 15, 2026: Bill C-36 tabled (first reading).
- Who does Canada Bill C-36 (PPCDA) apply to?
- Organisations handling personal information in the course of commercial activity (as under PIPEDA).
- What are the penalties under Canada Bill C-36 (PPCDA)?
- As tabled: administrative monetary penalties up to the greater of CAD 10 million and 3% of global revenue; criminal fines up to the greater of CAD 25 million and 5% of global revenue on indictment.