Follow-Up to Our PIPEDA Guide: What Bill C-36 Means for Ontario Businesses

This is a follow-up to our PIPEDA Guide for Ontario Businesses: Privacy Operations, which we first published in May 2024. That guide still describes the day-to-day privacy work PIPEDA expects from you. What has moved is the law reform around it. Rather than quietly rewrite an old post, we're putting the new developments here, with a date on them.

This post is general information, not legal advice. It can't tell you which privacy laws apply to your organization or whether you comply with them. Talk to a lawyer about your situation.

The short version

• PIPEDA is still the law. The consolidated Act on the Justice Laws website is in force and was last amended on March 4, 2025.
• Bill C-27 is dead. The reform bill a lot of people (us included) expected to replace PIPEDA never got out of committee.
• Bill C-36 is a proposal. It was introduced on June 15, 2026 and is sitting at second reading in the House of Commons. Nothing in it applies to your business today.

What happened to Bill C-27

Bill C-27, the Digital Charter Implementation Act, 2022, would have created a Consumer Privacy Protection Act, a new privacy tribunal and the Artificial Intelligence and Data Act. According to its LEGISinfo record, it had first reading on June 16, 2022 and passed second reading on April 24, 2023. Then it went to committee and stayed there.

That session of Parliament ended without the bill passing, and LEGISinfo shows it was never reinstated in a later session and never received royal assent. So if you read something in 2023 or 2024 about the Consumer Privacy Protection Act or the AI and Data Act "coming soon", none of it became law.

What Bill C-36 proposes

Bill C-36 is a government bill sponsored by the Minister of Artificial Intelligence and Digital Innovation. The first-reading text says it would enact a new Protecting Privacy and Consumer Data Act, repeal Part 1 of PIPEDA (the privacy part) and rename what's left the Electronic Documents Act.

A few things in the bill's table of provisions are worth knowing about if you run a small business:

• A privacy management program that organizations would have to maintain
• Rules on retention and disposal, including disposing of someone's information when they ask in writing and certain conditions are met
• Rules for de-identified and anonymized information
• Data mobility, so that in some cases an individual could have you send their information to another organization
• Tougher enforcement, with a maximum penalty of the greater of $10 million or 3% of gross global revenue for the contraventions found in one investigation
• A private right of action, so an individual could sue for damages once the Commissioner's finding of a contravention is final

Even if it passes, most of the new Act would come into force on a date set later by the federal cabinet, not on the day of royal assent.

As of this writing, LEGISinfo lists C-36 as "At second reading in the House of Commons". Its last completed stage is first reading on June 15, 2026. It hasn't been to committee or the Senate, and it can still be amended, stall or die the same way C-27 did. Treat any summary of it, including this one, as a description of a draft.

What it means for an Ontario small business

Ontario isn't on the Office of the Privacy Commissioner's list of provinces with their own general private-sector privacy law. The OPC's PIPEDA requirements in brief names Alberta, British Columbia and Quebec as the provinces with substantially similar private-sector laws. Ontario does have health-information legislation the OPC treats as substantially similar, which matters if you handle personal health information. If you also serve customers in Quebec, Alberta or BC, their laws may apply too, and that's a question for your lawyer.

For most Ontario businesses dealing with customer and supplier information in the course of commercial activity, that leaves PIPEDA as the law to work to right now. A few practical consequences:

• Don't buy "C-36 compliance". There's no final text to comply with. Anyone selling certainty about a bill at second reading is guessing.
• Don't rewrite your privacy notice around the bill. Your notice should describe what you do under the law that applies today.
• The groundwork carries over. The headings in C-36 line up closely with the work in our original guide: know your data, set retention, control access, manage vendors and keep breach records. If you have that done, you'll be adjusting a program later, not starting one.

What to do now

1. Keep the PIPEDA basics running. The OPC's breach guidance still applies: report breaches that pose a real risk of significant harm to the OPC, notify the people affected, and keep a record of every breach whether or not it meets that threshold.
2. Write down your retention periods. PIPEDA's fifth principle already expects retention rules, and C-36 would make them more explicit. Pick a period for each kind of record, write down why, and check that old data really does get deleted.
3. Put your privacy program on paper. Name the person accountable for privacy, list your policies and keep the evidence that they're followed. That's good practice under PIPEDA and it's the starting point for the program C-36 describes.
4. Know where you de-identify or anonymize data. If you strip names out of data for reporting, analytics or AI tools, note where and how. C-36 has its own section on de-identification, so this is easier to sort out now than later.
5. Check your vendor contracts. Know which service providers hold personal information, what they're allowed to do with it, and how they'll tell you about an incident.
6. Check LEGISinfo a few times a year. The bill's page shows the current stage. Committee study is usually where a bill's wording gets amended, so that's the stage to watch.

We'll post another dated follow-up if C-36 moves to committee, passes or dies, and we'll link it from the original guide the same way this one is.