--- title: "Canada — Data Subject Rights | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/canada/data-subject-rights/ source_html: /jurisdictions/canada/data-subject-rights/index.html description: "Canada — Data Subject Rights: data_subject_rights Data Subject Rights Not assessed ▾ # No standing position recorded for this category. Category narrative 296 words Data Subject Rights Bill C-36, as introduced at f" generated_at: 2026-10-25T04:46:50Z content_sha256: 83f23596d5f35a65d42d40dc8c3e2485def5b43d663a1c0632fd0e8bd90e018e generator: "fe-fleet/md-twin@1.0" --- # Canada — Data Subject Rights | Data Protection Monitor ### D3Data Subject RightsNot assessed▾# No standing position recorded for this category. Category narrative 296 words #### Data Subject Rights Bill C-36, as introduced at first reading on June 15, 2026, proposes a new deletion right for individuals that would extend to AI-generated content, allowing a person to request that an organisation delete personal data including AI deepfakes depicting them. This is a notable extension of the deletion-right concept beyond data an individual originally supplied or that was collected about them in the conventional sense, reaching instead into synthetically generated content that uses or depicts their personal information or likeness. Separately, and operating under a different legislative vehicle, the Budget 2025 Implementation Act has begun operationalising a data-mobility right within the existing Personal Information Protection and Electronic Documents Act framework, intended to facilitate economy-wide data sharing. This data-mobility right is connected to, though distinct from, the Consumer-Driven Banking Act's open-banking data-access framework: the PIPEDA-level mobility right provides the general data-protection law basis, while the Consumer-Driven Banking Act provides the sector-specific implementing structure for the financial-services context specifically. Both developments point toward an expansion of individual data-subject rights in Canada beyond PIPEDA's current baseline, which does not include an explicit, general-purpose data-portability or deletion right of the scope now proposed. Bill C-36's deepfake-deletion right remains proposed rather than in force, while the data-mobility right's operationalisation under the Budget 2025 Implementation Act appears to be further along, tied as it is to the enacted Consumer-Driven Banking Act framework, though the precise state of the mobility right's own implementation timeline was not independently confirmed against primary legislative text this cycle. #### Outlook The deepfake-deletion right's fate depends entirely on Bill C-36's passage; the data-mobility right's practical availability to individuals depends on the Consumer-Driven Banking Act's own implementing regulations and the Bank of Canada's accreditation timetable for participating entities, neither of which was confirmed as finalised this cycle. Read full narrative · 296 words no periodic updates on record for this sub-brief Evidence 0 — none recorded