Bill C-36, What's Coming and Why It Matters

PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law has been Canada's federal privacy law for a long time, and it was written for a much earlier version of the internet. Governments have been trying to replace it for years. The current attempt is Bill C-36The Protecting Privacy and Consumer Data Act, tabled June 2026 and still before Parliament, the Protecting Privacy and Consumer Data Act, introduced on 15 June 2026.

What it would change

It would replace the private sector half of PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law with a new statute, the Consumer Privacy Protection Act, and set up a Personal Information and Data Protection Tribunal to handle penalty decisions. The plumbing matters less to most business owners than the numbers attached to it.

The headline is the size of the stick. PIPEDAPersonal Information Protection and Electronic Documents Act, Canada's federal privacy law's enforcement has been modest in practice. Bill C-36The Protecting Privacy and Consumer Data Act, tabled June 2026 and still before Parliament proposes administrative monetary penalties up to $10 million or 3 percent of gross global revenue, whichever is greater, and up to $25 million or 5 percent of gross global revenue for the offence provisions. A percentage of revenue is a different kind of number than a flat fine, because it scales with the business rather than sitting still.

The second change is quieter but arguably bigger. The bill contemplates a private right of action, which would mean individuals could take you to court over privacy harms directly, rather than everything running through a regulator first. That would move privacy from something a government office might eventually look at to something a customer can act on. It is also exactly the kind of provision that gets argued over on the way through, so treat it as a proposal rather than a plan.

Why this is the good time, not the scary time

The stakes rising is precisely the argument for dealing with it now, calmly, while there is no pressure. The work that gets you ready is not exotic. It is a consent setup that works, tags that hold until someone agrees, and a real first party privacy policy. That is ordinary web work, and doing it now costs the same as doing it under a deadline, minus the panic.

Think of it as cheap insurance. The premium is a bit of web work today. The thing it insures against is a much larger, more expensive scramble later, when a rule is live and the penalties are real.

We are not lawyers and this is not legal advice. It is what the bill says as it stands, and what we see on real sites. For how any of it would land on your particular business, talk to a lawyer.

If you would like to know what closing that gap would actually involve for your site, that is a conversation we are happy to have without any of the fear selling.