--- title: "Canada — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/canada/regulator-and-framework/ source_html: /jurisdictions/canada/regulator-and-framework/index.html description: "Canada — Regulator & Framework: regulator_and_framework Regulator & Framework 2 sub-modules 2 claims Not assessed ▾ # No standing position recorded for this category. Sub-modules (2) Regulator And Authority Not a" generated_at: 2026-10-25T04:46:50Z content_sha256: bbb851790dbab2280e75da7defb9a5f87dae07877019f85548331ffff19d7c4e generator: "fe-fleet/md-twin@1.0" --- # Canada — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework2 sub-modules2 claimsNot assessed▾# No standing position recorded for this category. #### Sub-modules (2) #### Regulator And AuthorityNot assessed No narrative recorded for this sub-module. Claims (1): - PIPEDA applies except where: PIPEDA applies to private-sector organisations except where a province has 'substantially similar' legislation; Quebec, British Columbia and Alberta are recognised as such. #### Act And InstrumentsNot assessed No narrative recorded for this sub-module. Claims (1): - Bill C-36 (Protecting Privacy and Consumer Data Act) introduced: Bill C-36 was introduced 15 June 2026 as a focused privacy/consumer-data bill, unbundling AI regulation (AIDA) from the privacy-reform package that Bill C-27 had combined before it died on the Order Paper at the 6 January 2025 prorogation. Category narrative 270 words #### Regulator & Framework Canada's federal private-sector privacy regime remains anchored in PIPEDA, enforced by the Office of the Privacy Commissioner of Canada, with Quebec, British Columbia and Alberta operating their own provincial statutes deemed "substantially similar" and which displace PIPEDA for intra-provincial commercial activity. This multi-layered architecture is unchanged as a structural matter this cycle. What has changed is the reform trajectory sitting above this baseline. Bill C-27, which had contained the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act, died on the Order Paper at prorogation on January 6, 2025, and was not reintroduced in its original form after the April 2025 general election. Federal privacy reform has now returned, reported in June 2026 as Bill C-36, proposing to replace PIPEDA outright with a new Protecting Privacy and Consumer Data Act. This is reported at Probable confidence; the bill's precise legislative reading-stage status has not been independently confirmed against LEGISinfo this cycle. The context in which this reform proposal is being read is a set of enforcement gaps that have persisted since Bill C-27's death: the Privacy Commissioner continues to lack order-making power and the ability to levy administrative monetary penalties directly, gaps that C-27 had been designed to close and which a successor bill would presumably need to address again. #### Outlook Watch for Bill C-36's progress through further legislative readings and for independent confirmation of its reading-stage status on LEGISinfo. Whether a revived reform effort can close the order-making and AMP enforcement gaps that outlived Bill C-27 will be the central substantive question as this bill advances. Read full narrative · 270 words Periodic update · new data 2026-10-18 #### Regulator & Framework The central development in Canada's data-protection framework this cycle is the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, in the House of Commons on June 15, 2026. As introduced, the bill would enact the Protecting Privacy and Consumer Data Act to govern the protection of personal information while taking into account the needs of organisations, and it would repeal the privacy provisions currently found in the Personal Information Protection and Electronic Documents Act. In place of the Office of the Privacy Commissioner's current enforcement role under PIPEDA, the bill proposes a new Digital Safety and Data Protection Commission of Canada, a dedicated enforcement body with powers to issue binding orders against non-compliant organisations. This is a proposed instrument, not yet enacted, and its first-reading status means its provisions remain subject to committee review, amendment and further readings before any final form is settled. The scale of the proposed change, however, is substantial on its face: a shift from PIPEDA's current enforcement model, which relies on the Privacy Commissioner's recommendation-based powers with limited direct penalty authority, to a dedicated Commission with binding enforcement powers would represent the most significant architectural change to Canadian federal private-sector privacy law since PIPEDA's original enactment. The bill's introduction does not alter the current operative framework. PIPEDA remains in force in its existing form, and the Office of the Privacy Commissioner continues to exercise its existing powers, including the capacity demonstrated this cycle through its joint investigation of OpenAI, while Bill C-36 proceeds through the legislative process. Organisations operating in Canada should therefore treat the current PIPEDA framework, including the Privacy Commissioner's existing oversight role, as the operative regime, with Bill C-36 representing a proposed future state rather than a present obligation. #### Outlook The pace and outcome of Bill C-36's passage through committee and subsequent House and Senate readings will determine when, and in what final form, the Digital Safety and Data Protection Commission comes into existence and PIPEDA's privacy provisions are repealed. As at this cycle, the bill has passed only first reading, and no committee timetable was located in the material reviewed. 2 earlier distinct update(s) Periodic update · new data 2026-10-11 #### Regulator & Framework Canada's federal privacy-framework reform advanced procedurally this cycle with the first reading of Bill C-36, the Protecting Privacy and Consumer Data Act, on 15 June 2026. The bill drops the Artificial Intelligence and Data Act entirely and proposes a new Digital Safety and Data Protection Commission of Canada, carrying order-making and administrative-monetary-penalty powers that would take over the private-sector enforcement role currently held by the Office of the Privacy Commissioner under the Personal Information Protection and Electronic Documents Act. The Privacy Commissioner has publicly welcomed several of the bill's features, including its recognition of privacy as a fundamental right, its best-interests-of-the-child provisions, its mandatory privacy-impact-assessment requirements and its stronger enforcement powers, while also noting that the bill would transfer private-sector oversight responsibilities away from the Office itself to the new Commission. As of 11 October 2026, the bill remains at first reading with no committee or passage activity recorded. #### Outlook The bill's progress through committee stage is the development most likely to determine the shape of Canada's private-sector privacy enforcement over the coming year; its proposed Commission, if enacted, would mark a structural departure from the current OPC-centred model. Periodic update · new data 2026-10-04 #### Regulator & Framework Canada's federal private-sector privacy framework remains anchored in PIPEDA, which applies except where a province has enacted substantially similar legislation, with Quebec, British Columbia and Alberta recognised as meeting that standard. This jurisdictional-scope rule continues to define the practical division of regulatory authority between the federal Office of the Privacy Commissioner and the recognised provincial regulators. On 15 June 2026 the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, as the successor to Bill C-27, which died on the Order Paper when Parliament prorogued on 6 January 2025. The most structurally significant feature of Bill C-36 is understood to be what it does not contain: whereas Bill C-27 had combined privacy reform with the Artificial Intelligence and Data Act in a single package, Bill C-36 addresses only privacy and consumer-data matters, leaving AIDA, and AI governance generally, without any legislative successor. This is reported as a deliberate unbundling rather than an oversight, separating the comparatively more settled privacy-reform agenda from the more contested AI-governance debate. Whether Bill C-36 has progressed past first reading since its 15 June 2026 introduction had not been independently established this cycle. The bill's introduction nonetheless represents the most concrete sign of continued federal legislative activity on private-sector privacy reform since the C-27 prorogation, and its privacy-only scope is understood to reduce at least one source of legislative complexity, AI-governance controversy, that had previously slowed the combined package's progress. #### Outlook The pace of Bill C-36's progress through Parliament is the central open question for Canada's federal privacy-framework trajectory. Its unbundled, privacy-only scope may improve its prospects relative to the combined C-27 package, though no committee-stage or second-reading developments had been established this cycle. The continued absence of a legislative vehicle for AI-specific governance means that, for the foreseeable future, AI-adjacent personal-information practices will likely continue to be addressed through general-purpose PIPEDA tools rather than dedicated AI law. Evidence 2 Sources and claims (2) - Probableunavailable — PIPEDA applies except where: PIPEDA applies to private-sector organisations except where a province has 'substantially similar' legislation; Quebec, British Columbia and Alberta are recognised as such. - Probableunavailable — Bill C-36 (Protecting Privacy and Consumer Data Act) introduced: Bill C-36 was introduced 15 June 2026 as a focused privacy/consumer-data bill, unbundling AI regulation (AIDA) from the privacy-reform package that Bill C-27 had combined before it died on the Order Paper at the 6 January 2025 prorogation.