New Brunswick, Canada Data Protection & Privacy Regulation

Other Developments

Rising national complaint volume. The Office of the Privacy Commissioner of Canada recorded 3,044 complaints under PIPEDA in the most recent fiscal year, an increase of 109% over 2024-2025, attributed in part to AI-enhanced search engines increasing public awareness of the complaints process. No New Brunswick-specific breakdown of this figure has been published, so the development is reported here as the national backdrop against which any future New Brunswick-originating complaint would be assessed.

AI and automated-decision-making definitions under review. The RTIPPA legislative review's recommendation to define artificial intelligence, generative artificial intelligence and automated decision-making responds to documented public-body use of such systems in New Brunswick's law enforcement, university and municipal sectors. This recommendation remains at the review stage; it has not yet become a tabled bill, still less an enacted provision.

Cross-Monitor Connections

The RTIPPA review's proposed biometric and automated-decision-making definitions touch territory the artificial-intelligence monitor is better placed to analyse for algorithmic-governance implications in New Brunswick's public sector specifically; it is noted here only as a data protection definitional development. The federal PIPEDA penalty and breach-notification framework discussed below also has a commercial-compliance dimension that the financial-integrity monitor's reporting-entity obligations occasionally intersect with, though no such intersection was evidenced in New Brunswick this period.

Outlook

What would move the RTIPPA reform signal from a review recommendation to a binding obligation is the tabling of reform legislation; sources diverge on timing, with some suggesting introduction in the latter part of 2026 and others suggesting early 2027. The rising national PIPEDA complaint volume is a backdrop worth monitoring for any New Brunswick-specific breakdown that may later be published, which would sharpen the current national-only picture into a provincial one.

1 earlier update not shown here.

Standing brief · as of 23 August 2026

Written before the update above. Where they differ, the update is the more recent position.

Lead Signal

Bill C-36, introduced in Parliament on 2026-06-15, would enact the Protecting Privacy and Consumer Data Act and, in doing so, repeal Part 1 of PIPEDA and create a new Digital Safety and Data Protection Commission of Canada. The Office of the Privacy Commissioner of Canada is the primary federal regulator investigating complaints and promoting compliance under the existing PIPEDA regime, and New Brunswick has no independent private-sector privacy regulator standing alongside it: private-sector data protection in the province sits entirely within this federal PIPEDA-to-PPCDA reform track, with the province's Right to Information and Protection of Privacy Act governing only New Brunswick's public bodies rather than extending to private-sector businesses. The introduction of Bill C-36 is the dominant development of the cycle and, if enacted, would be the most significant restructuring of Canada's private-sector privacy regulator and framework since PIPEDA's original enactment. The proposed Commission would replace the current Commissioner model with a body carrying enhanced enforcement powers, consistent with a broader pattern across this cycle of Canadian federal privacy reform moving toward more codified, more heavily enforced obligations across each of the four modules addressed here.

Other Developments

A new data-mobility right has been legislated as an amendment to PIPEDA, giving individuals the ability to request that prescribed organizations, such as banks, provide specified personal information in a structured, commonly used technological format to an authorized recipient. This mobility right is enacted but not yet effective: implementing regulations that would operationalize the right are anticipated in 2026, and until those regulations are in place the right remains a legislated entitlement without an operative mechanism. The mobility right is explicitly targeted at organizations holding data of the kind held by banks, an early signal that Canada's approach to open banking and open finance is being coordinated with, rather than left separate from, privacy-law reform.

Bill C-36's proposed Protecting Privacy and Consumer Data Act would require every organization to implement and maintain a formal privacy management program, a more codified accountability obligation than PIPEDA's current principle-based approach. This sits alongside PIPEDA's existing, settled breach-notification regime, in force since November 2018, which requires organizations to report breaches of security safeguards to the Office of the Privacy Commissioner and to notify affected individuals where a breach creates a real risk of significant harm; that breach-notification baseline is unchanged this cycle and continues to operate regardless of the proposed reform.

Enforcement exposure under the proposed framework is reported, at assessed rather than confirmed confidence, to include penalties of up to the greater of C$25 million or five percent of gross global revenue, though this penalty ceiling has not been independently confirmed against the bill text this cycle and should be read as an early indication of the reform's intended enforcement severity rather than a settled figure. Read together with the formal privacy management program obligation proposed for controllers and processors, the reported penalty ceiling suggests a reform package oriented toward proactive compliance programs backed by a materially higher enforcement ceiling than PIPEDA currently carries, though the precise consent-threshold and penalty provisions were not confirmed against bill text this cycle.

Cross-Monitor Connections

The financial-integrity monitor separately tracks the federal financial-crimes reform track running in parallel with this privacy reform, including information-sharing arrangements between law enforcement and financial institutions that are understood to leave existing PIPEDA-derived privacy obligations undisturbed rather than superseding them. Readers following both monitors should expect the privacy-reform and financial-crime-reform tracks to be treated as coordinated but analytically distinct developments, with this monitor confined to the privacy-law dimension.

Outlook

The most consequential open questions for the cycle ahead are legislative: whether Bill C-36 advances through the parliamentary process toward the Digital Safety and Data Protection Commission of Canada it would create, and whether the reported C$25-million-or-5-percent-of-global-revenue penalty ceiling survives to enactment in that form. On the data-subject-rights side, the publication of implementing regulations for the PIPEDA data-mobility right, anticipated in 2026, is the concrete marker that would move that right from legislated entitlement to operative mechanism. New Brunswick businesses will experience each of these developments through the federal track alone, since the province's own privacy statute does not extend to the private sector. Because several of this cycle's most consequential figures, the penalty ceiling chief among them, rest on secondary legal-commentary sourcing rather than confirmed bill text, a future cycle in which the bill text itself becomes available for direct citation would materially change the confidence posture of the enforcement and regulator-and-framework modules.

Outlook

All of the material developments tracked for New Brunswick this cycle originate at the federal level, and the province's regulatory trajectory will continue to track Bill C-36's legislative progress directly, with implementing regulations for the data-mobility right and confirmation of the proposed penalty ceiling the two concrete markers to watch.