Bill C-36 Hub
Canada's third attempt to replace PIPEDA.
Here is what it means for a company like yours. This hub tracks Bill C-36, the proposed Protecting Privacy and Consumer Data Act, through Parliament and translates the draft into plain, operational guidance for teams that already did Law 25.
How this page stays current. Re-checked against LEGISinfo on the 1st of each month and after every parliamentary milestone: second-reading debate, committee referral, committee amendments, report stage, third reading, each Senate stage, and royal assent. Each check updates the parliamentary delta below and this date.
Parliamentary delta
First reading to today: what changed
Nothing yet. The first-reading text of June 15, 2026 is still the current text of the bill: no second-reading debate, no committee referral, no amendments. Each provision below carries its reading-stage label, checked November 4, 2026, so a moved section number cannot slip through silently.
| Provision | Section | What the text says | Stage status |
|---|---|---|---|
| Inferred information counts as personal information | s. 2(1) | "personal information means information about an identifiable individual, including information that is inferred about the individual" | First reading, unchanged |
| Child defined as under 18 | s. 2(1) | "child means an individual who is under 18 years of age" | First reading, unchanged |
| Appropriate purpose | s. 12(1) | Collection, use, or disclosure "only in a manner and for purposes that a reasonable person would consider appropriate in the circumstances, whether or not consent is required under this Act" | First reading, unchanged |
| Secondary purpose needs fresh consent | s. 14(1) | "must not use or disclose personal information for a purpose other than a purpose determined and recorded under subsection 12(3), unless the organization obtains the individual's valid consent" | First reading, unchanged |
| Legitimate interest: a gated consent exception | s. 18(3), gate at s. 18(4) | The exception is s. 18(3); the gate is s. 18(4). Before using it, the organization must "carry out, in accordance with the prescribed requirements, a privacy impact assessment" (s. 18(4)(b)) and record the interest (s. 18(5)). Section numbers verified in the current text. | First reading, unchanged |
| Behavioral-influence bar on consent exceptions | s. 18(1)(b), s. 18(3)(b) | Personal information must "not [be] collected, used or disclosed for the purpose of influencing the individual's behaviour or decisions" | First reading, unchanged |
| Cross-border transfers need a PIA first | s. 57(1) | "Before disclosing or transferring personal information outside of Canada, an organization must (a) carry out, in accordance with the prescribed requirements, a privacy impact assessment; and (b) implement measures to mitigate the risks" | First reading, unchanged |
| Automated decisions: transparency, explanation, contestation | s. 62(2)(c), s. 63(4)-(6) | A "general account" of automated decision system use with legal or similarly significant effects; on request, an explanation stating "the type of personal information that was used ..., the source of the information and the reasons or principal factors"; plus "an opportunity to make written representations to an employee of the organization who is able to review" the decision | First reading, unchanged |
| Administrative monetary penalties | s. 114 | "the greater of $10,000,000 and 3% of the organization's gross global revenue" for all contraventions in one investigation | First reading, unchanged |
| Offences | s. 145 | Indictable: "the greater of $25,000,000 and 5%" of gross global revenue; summary conviction: "the greater of $20,000,000 and 4%" | First reading, unchanged |
| New institutions | ss. 2, 85, 89 | s. 2 defines the Commission as "the Digital Safety and Data Protection Commission of Canada referred to in section 4 of the Digital Safety and Data Protection Commission of Canada Act", a separate Act. C-36 itself creates the Privacy and Consumer Data Commissioner (s. 85) and the Privacy and Consumer Data Division (s. 89). | First reading, unchanged |
v1, November 4, 2026. First-reading text verified against Parliament's DocumentViewer. No amendments exist yet. The next version lands with the first committee reprint.
Source text: Bill C-36, first reading (Parliament of Canada).
For teams that did Law 25
I did Law 25. What is new for me?
Eight upgrades deserve immediate attention. A Law 25 control can be reused only after its trigger, scope, decision rule, evidence, and owner are mapped to the proposed federal requirement. Open each delta below.
1. Federal reach
The proposal would cover commercial activity, federal-sector employee data, and interprovincial or international handling, subject to exemptions. Where PIPEDA already applied, the new statute is broader. You need a record-level jurisdiction and flow rule, not a single "we are covered" determination.
If a substantially similar provincial law governs an intra-provincial activity, it continues to apply there. The overlap question is per data flow, so map applicability at the flow level.
Add a jurisdiction column to your data inventory: for every flow, record why it falls under the proposed federal statute, a substantially similar provincial law, or both. Revisit any flow that crosses provincial or national borders.
2. Inferred information counts as personal information
The definition of personal information expressly includes information inferred about an individual. Scores, segments, predictions, profiles, and model outputs you derive from other data are in scope, not just the inputs you collected.
This closes a gap many teams left in their Law 25 inventories: derived attributes were documented as analytics metadata rather than personal information. Under C-36 they attract the same duties, including access, correction, and disposal.
Extend your data inventory to list inferred outputs: risk scores, customer segments, churn predictions, recommendation profiles, and any model output tied to an individual. Tag their lineage, retention, and where they are disclosed.
3. Children's information starts at under 18
Under the proposal, a child is under 18, and children's information is listed as sensitive. Law 25's consent rule for children draws the line at 14. If your controls stop at 14, teens aged 14 to 17 are uncovered.
Sensitive information attracts heightened protection duties. Treat the under-18 population as a distinct control layer across collection, use, disclosure, and security, not as an extension of the under-14 consent workflow.
Build an under-18 control overlay across every product surface: age detection, consent flows, default privacy settings, and marketing exclusions. Do not rely on Law 25's under-14 rule alone.
4. Legitimate interest: a gated consent exception
The proposed legitimate-interest exception lets an organization collect, use, or disclose personal information without consent, but only when a recorded interest outweighs the foreseeable adverse effects on the individual. The gate requires a documented interest, a privacy impact assessment, an adverse-effect analysis, and mitigation measures.
This is the consent exception most likely to be misused. Casual "we have a legitimate interest" reasoning will not survive scrutiny without the recorded analysis behind it.
Create a gated assessment that blocks any legitimate-interest use until the interest is recorded, a PIA is completed, adverse effects are analyzed, and mitigations are in place. Ban informal use of this exception.
5. Transfers outside Canada need a PIA first
Before personal information is disclosed or transferred outside Canada, the proposal would require a privacy impact assessment and mitigations. Law 25 teams already do transfer assessments, but for Quebec-origin transfers. The C-36 trigger is any Canada-origin outbound flow.
The duty attaches before the transfer happens. Your existing transfer assessment workflow needs a new gate: no outbound disclosure without a completed PIA and documented mitigations.
Adapt your Quebec transfer assessment to a Canada-origin trigger. Inventory every cross-border disclosure, including processors and sub-processors, and run the assessment before the first transfer, not after.
6. Automated decisions: explanation and human review
Systems that assist or replace human judgment can trigger explanation and human-review duties when they produce legal or similarly significant effects on individuals. This reaches beyond fully automated decisions: decision-support systems are in scope too.
Law 25 teams inventoried exclusively automated decisions. The C-36 lens is wider, so your inventory needs to capture assistive systems like scoring and recommendation engines.
Broaden the automated-decision inventory beyond exclusively automated systems. For each system, document the effect it can have on individuals, what explanation you provide, and how a person can request human review.
7. Disposal orchestration, including downstream
Disposal requests can require deletion or anonymization and downstream service-provider action, with documented exceptions. Deleting a row in your own database is not enough when copies live with processors.
You need deletion propagation: a defined path from request intake to every downstream holder, plus refusal records for documented exceptions where disposal does not apply.
Build deletion propagation into your request workflow: map which service providers hold personal information, define the disposal instruction you send them, track completion, and record the reason for any documented exception.
8. Regulator-ready evidence
The proposed Privacy Commissioner can request program materials, investigate, audit, and order measures. The question is not whether you have policies, but whether you can produce the evidence behind them on demand.
"We already do PIAs" is not enough if the PIA gate misses legitimate-interest uses or transfers outside Canada. Each control needs its trigger, scope, decision rule, evidence, and owner mapped to the proposed federal requirement.
Create an indexed evidence room: every program control filed with its trigger, scope, decision rule, evidence, and owner. Run quarterly control tests so the materials are current before the regulator ever asks.
The hub
Everything in one place
Readiness assessment
A free self-assessment that scores your privacy program against the 8 deltas and tells you what to fix first.
Templates
Working templates: legitimate interest assessment, transfer assessment, deletion records, and more.
Tool finder
Match your gaps to tool capabilities, like deletion orchestration, so you know what to shop for.
Training
Role-based learning paths for developers, marketers, HR, and leadership on the proposed duties.
Glossary
Plain-language definitions of C-36 terms: inferred information, automated decision systems, and others.
Legislative briefing
The tracker: where the bill stands in Parliament, and how to get an email when it moves.
Readiness review
A fixed-scope expert review of your program against the 8 deltas, with a prioritized roadmap.
Where to go next
- Run the free readiness assessment and see where your program stands.
- Get an email when the bill moves, with a plain-language briefing.
- Book a readiness review if you want an expert to validate the work.