Update: C-27 was not passed
Bill C-27, the Digital Charter Implementation Act, 2022, was introduced in June 2022. It died on the order paper on January 6, 2025, when Parliament was prorogued. None of the laws it proposed (the CPPA, the Personal Information and Data Protection Tribunal Act, AIDA) is in force. An earlier version of this article said the opposite. That was an error, now corrected.
What C-27 proposed
The bill would have replaced the privacy part of PIPEDA with the Consumer Privacy Protection Act (CPPA). It set out tighter rules on consent, de-identified data and minors' information, new powers for the Privacy Commissioner, a tribunal to impose penalties, and fines of up to 5% of global revenue or $25 million for the most serious offences. It also added the Artificial Intelligence and Data Act (AIDA) for high-impact AI systems.
What actually applies today
Federally regulated businesses, and provinces without a similar law, remain under PIPEDA, in force since 2000. The Commissioner can investigate and make recommendations, but cannot issue orders or impose fines. In Quebec, Law 25 gives much stronger protection. Alberta and British Columbia have their own private-sector laws.
Where the reform stands
The government has signalled that C-27's measures will not return as they were. According to law-firm analyses, a new privacy bill was tabled in the House of Commons in June 2026. Check its status on the Parliament of Canada website before relying on any summary, this one included: a bill can change or die at any stage.
What to do in the meantime
You can request access to your personal information and challenge how it is used under PIPEDA, and complain to the Commissioner if a company refuses. In Quebec, go to the company first, then to the Commission d'accès à l'information. For businesses, the best preparation is still to comply with PIPEDA and, if you serve Quebecers, with Law 25.