Bill C-36 Consumer Data Act

Read Full Bill Text Here

C-36 An Act to Enact the Protecting Privacy and Consumer Data Act, to Amend the Personal Information Protection and Electronic Documents Act and to Make Amendments to Other Acts

Bill Type:  House Government Bill

Bill Sponsor:  Minister of Artificial Intelligence and Digital Innovation

STATUS: At 2nd Reading in the House of Commons. Introduced — 1st Reading, June 15, 2026.

This Bill comes into force by Order in Council.

Estimated read time: 5 minutes

  • ⚠️Most of the Bill cannot come into force before Part 3, which restructures the Digital Safety Commission into the Digital Safety and Data Protection Commission. If C-34 receives Royal Assent, Part 3 cannot come into force before C-34’s Digital Safety Commission is established.

WHAT IS THIS BILL FOR?

Bill C-36 replaces Canada's existing private-sector Privacy Law (PIPEDA) with a new, stronger Act called the Protecting Privacy and Consumer Data Act. It sets out rules for how businesses collect, use and share your personal information and creates a new enforcement body with real teeth to hold them accountable.

WHO GAINS POWER

  • The new Digital Safety and Data Protection Commission of Canada — a renamed and expanded version of the existing Digital Safety Commission — gets broad authority to investigate, audit, fine and order businesses to comply
  • ⚠️ The Privacy and Consumer Data Commissioner may initiate a complaint when there are reasonable grounds to investigate and audit an organization on reasonable notice when there are reasonable grounds to believe it has contravened, is contravening or is likely to contravene the Act. During an investigation or audit, the Commissioner may enter an organization’s non-residential premises at a reasonable time after meeting its security requirements. The Bill does not require a Warrant for this entry.
  • The Privacy and Consumer Data Division handles dispute resolution, certification programs and interim orders
  • Government institutions retain the ability to request personal information from businesses for Law Enforcement, National Security and regulatory purposes — without your knowledge or consent
  • Individuals can request access to and correction of their personal information. They may request disposal in specific circumstances, subject to exceptions; disposal can include anonymizing the information. They may request transfer to an organization of their choice when both organizations are covered by a data mobility framework. An individual who suffers loss or injury may sue after a qualifying confirmed contravention or offense.
  • ⚠️ If substantially similar privacy Legislation applies in a Province, the Governor in Council may by Order exempt an organization, class of organizations, activity or class of activities from this Act for personal information collected, used or disclosed within that Province. This power does not exempt the Province as a whole.

    WHO LOSES POWER
  • Businesses lose the ability to collect, use or share personal information without a clear lawful basis — consent, legitimate interest or a listed exception
  • Organizations must make general information available about automated decision systems used for decisions with legal or similarly significant effects. When an individual makes a written access request about such a decision, the organization must explain the information used, its source and the main reasons for the decision, then give the individual an opportunity to make written representations to an employee able to review it.
  • Organizations must ensure that service providers give transferred personal information an equivalent level of protection, by contract or otherwise. A service provider must notify the organization if it discovers a breach. Most Part 1 duties do not apply directly to a provider handling information only for the organization’s stated purposes; those duties apply if it uses or discloses the information for another purpose.
  • ⚠️ Individuals may be denied access to information about certain Government disclosures if they request it and the institution objects on specified grounds. In that case, the organization must refuse access and cannot tell the individual that it notified the institution, that the institution objected or that it notified the Commission.

    WHO GAINS MONEY
  • Individuals can sue organizations directly for damages after a confirmed contravention — in Federal Court or a Provincial Superior Court
  • The Receiver General collects all administrative monetary penalties paid under this Act
  • Legal and compliance professionals will see significant demand as organizations build privacy management programs, conduct privacy impact assessments and navigate certification processes

WHO LOSES MONEY

  • ⚠️ Administrative monetary penalties apply only to specified contraventions. For all contraventions found after one investigation, the maximum is the greater of $10,000,000 and 3% of the organization’s gross global revenue in the financial year before the penalty is imposed. No administrative penalty may be imposed if the organization establishes that it exercised due diligence to prevent the contravention.
  • ⚠️ Knowingly contravening specified breach-reporting, recordkeeping, retention, de-identification, whistleblower-protection or Commission-order duties, or obstructing an investigation, audit or proceeding, can be a criminal offense. The maximum on indictment is the greater of $25,000,000 and 5% of gross global revenue. On summary conviction, the maximum is the greater of $20,000,000 and 4%.
  • Organizations must maintain privacy-management programs and meet applicable security, transparency and breach duties. Additional costs, such as privacy impact assessments, data-mobility requirements and third-party audit reports, depend on the organization’s activities and which requirements apply.

THE CATCH

  • ⚠️ "Legitimate interest" allows organizations to collect, use or disclose personal information without your knowledge or consent if their legitimate interest outweighs any potential adverse effect on the individual and a reasonable person would expect the activity. They cannot rely on this exception to influence an individual’s behavior or decisions. Before acting, they must conduct a privacy impact assessment and implement measures to mitigate risks. The Commission may request the assessment; the Act does not require advance Commission approval.
  • ⚠️ Regulations set important details, including the scope of certain business activities, required security safeguards, categories of publicly available information that may be handled without consent and data-mobility requirements. The Act itself sets core rules and exceptions, so these details are not all left to regulations.
  • ⚠️ Organizations may disclose personal information to Government institutions without your knowledge or consent for purposes authorized by the Act. If you request access to information about a covered disclosure and the institution objects on specified grounds, the organization must withhold access. It cannot tell you that it notified the institution, that the institution objected or that it notified the Commission.
  • ⚠️ The Bill does not come into force until a separate Bill (C-34, the Safe Social Media Act) also receives Royal Assent — meaning this privacy Law is contingent on Legislation passing first
  • ⚠️ The Act generally prohibits using de-identified personal information to identify someone but lists several exceptions, including valid consent, specified legal uses and certain testing. The Division may also authorize re-identification when it considers it clearly in the individual’s interests. De-identified information remains personal information under the Act.