Canada Consumer Privacy Protection Act (CPPA) Bill C-27

Bill C-27 (Consumer Privacy Protection Act, Data Protection Tribunal Act, AI and Data Act) died on the order paper when Parliament was prorogued in January 2025. Replaced by Bill C-36, the Protecting Privacy and Consumer Data Act, introduced 15 June 2026.

Analysis

Bill C‑27 (Digital Charter Implementation Act, 2022) would create the Consumer Privacy Protection Act (CPPA), repeal Part 1 of PIPEDA, and introduce the Artificial Intelligence and Data Act (AIDA) with significant new rights, obligations, and penalties (up to 5% of global revenue or C$25M for offenses).Bill C‑27 text – Parliament of Canada Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27

Key Requirements (CPPA & AIDA)

Core CPPA obligations on organizations

• Lawful, appropriate purposes and data minimization
• Organizations may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only the information necessary for those purposes.Legislative Summary – Parliament of Canada Bill C‑27 – s.12(1)
• Purposes must be identified and recorded at or before collection, and new purposes must also be recorded and supported by valid consent or a consent exception.Legislative Summary – Parliament of Canada Bill C‑27 – s.12(3)–(4)

• Valid consent and consent exceptions
• Organizations must obtain valid consent for collection, use, or disclosure unless an exception applies; consent must be free, informed, and based on clear information about purposes and reasonably foreseeable consequences.Bill C‑27 – s.15(1) Legislative Summary – Parliament of Canada
• Consent is invalid if obtained by deception, coercion, or as a condition of service where not necessary for the service.Bill C‑27 – s.15(7), s.16 BLG business impact analysis
• CPPA introduces specified business activity and legitimate interest exceptions to consent, along with exceptions for socially beneficial purposes, business transactions, and certain operations.Legislative Summary – Parliament of Canada ACC summary of Bill C‑27 IAPP overview of Bill C‑27

• Privacy management program
• Organizations must implement and maintain a privacy management program, including policies, practices, and procedures to ensure compliance with the CPPA and to protect personal information.ACC summary of Bill C‑27 BLG business impact analysis
• Failures in establishing and implementing such a program can trigger administrative monetary penalties.ACC summary of Bill C‑27 IAPP overview of Bill C‑27

• Security safeguards and breach notification
• Organizations must protect personal information with physical, organizational, and technological safeguards, proportionate to the sensitivity of the information.Legislative Summary – Parliament of Canada Bill C‑27 – security obligations (Part 1)
• Organizations must notify the Privacy Commissioner and affected individuals as soon as feasible about breaches that create a real risk of significant harm, similar to but more structured than PIPEDA’s breach requirements.Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27

• Service providers and cross‑border transfers
• Organizations remain responsible for personal information handled by service providers and must ensure they provide equivalent protection and comply with CPPA requirements.BLG business impact analysis ACC summary of Bill C‑27
• The CPPA clarifies obligations for transfers to service providers, which are subject to penalties when non‑compliant.BLG business impact analysis ACC summary of Bill C‑27

Individual rights (access, correction, portability, disposal/erasure)

• Right of access and correction
• Individuals have the right to access their personal information held by an organization and to challenge the accuracy and completeness of the information.Legislative Summary – Parliament of Canada BLG industry feedback paper
• Organizations must provide access while protecting the privacy of other individuals (e.g., severing third‑party information).Legislative Summary – Parliament of Canada Bill C‑27 – s.70

• Right to disposal / erasure
• CPPA includes a right to erasure (“disposal”): individuals can request that organizations dispose of their personal information, subject to limited exceptions.Legislative Summary – Parliament of Canada ACC summary of Bill C‑27
• Under Bill C‑27, the disposal right applies to all personal information about an individual, not just data “collected from” the individual as in Bill C‑11.ACC summary of Bill C‑27 IAPP overview of Bill C‑27

• Data portability (data mobility framework)
• CPPA establishes a portability right within a designated data mobility framework, requiring organizations to transfer an individual’s personal information to another organization at the individual’s request when both are subject to such a framework.IAPP overview of Bill C‑27 Legislative Summary – Parliament of Canada

• Use of de‑identified information and prohibition on re‑identification
• Organizations may use de‑identified information for certain internal purposes (e.g., research, development, improving services) but are prohibited from re‑identifying it except in narrow circumstances (such as fulfilling a data portability request).Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27

Enforcement, penalties, and private right of action

• Administrative monetary penalties and offenses
• The Personal Information and Data Protection Tribunal Act establishes a tribunal to impose administrative monetary penalties for CPPA contraventions, up to C$10 million or 3% of global revenue, whichever is greater.Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27
• Serious offenses under the CPPA can attract fines up to C$25 million or 5% of global gross revenues, higher than penalties under many comparable regimes.BLG industry feedback paper IAPP overview of Bill C‑27

• Order‑making powers and audits
• The Privacy Commissioner of Canada gains order‑making powers (e.g., to require that organizations change practices, comply with CPPA, or cease certain processing).IAPP overview of Bill C‑27 BLG industry feedback paper
• The Commissioner can audit organizations’ privacy management practices where there are reasonable grounds to believe a contravention or likely contravention.BLG business impact analysis Legislative Summary – Parliament of Canada

• Private right of action
• Individuals gain a private right of action to bring claims for loss or damage resulting from CPPA contraventions, after a finding by the Commissioner or Tribunal.IAPP overview of Bill C‑27 American Bar Association analysis

Artificial Intelligence and Data Act (AIDA) – high‑impact AI

• Scope: high‑impact AI systems and regulated activities
• AIDA would regulate “high‑impact AI systems” and AI development/operation activities that pose significant risks of harm or biased outputs.Legislative Summary – Parliament of Canada Bill C‑27 – AIDA Part 3
• It applies to persons responsible for AI systems (developers, managers, deployers) in Canada or in relation to AI systems made available in Canada.Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27

• Risk management, monitoring, and transparency
• Persons responsible for high‑impact AI systems must identify, assess, and mitigate risks of harm and biased output, and implement monitoring throughout the system’s lifecycle.Legislative Summary – Parliament of Canada Bill C‑27 – AIDA risk obligations
• There are record‑keeping and transparency obligations, such as publishing information about the intended use, limitations, and risks of high‑impact AI systems.Legislative Summary – Parliament of Canada IAPP overview of Bill C‑27

• Enforcement and penalties under AIDA
• AIDA introduces offenses and penalties for non‑compliance with AI obligations, including for making available or using AI systems that cause serious harm through reckless or knowing conduct.Legislative Summary – Parliament of Canada Bill C‑27 – AIDA enforcement provisions

Compliance Challenges

Because Bill C‑27 has not yet been fully enacted, challenges are drawn from industry feedback, legal analyses, and comparisons to PIPEDA and provincial reforms.

• Designing and maintaining a robust privacy management program
• Organizations report difficulty in translating CPPA’s broad requirement for a privacy management program into concrete, resourced structures (policies, training, governance, vendor management).ACC summary of Bill C‑27 BLG business impact analysis
• BLG’s feedback paper highlights concerns from industry participants about regulatory expectations for program depth and documentation, particularly for small and medium enterprises.BLG industry feedback paper IAPP overview of Bill C‑27

• Operationalizing legitimate interest and consent exceptions
• Organizations face challenges in applying the new legitimate interest exception, including conducting privacy impact assessments (PIAs) and demonstrating that interests outweigh potential adverse effects on individuals.ACC summary of Bill C‑27 BLG business impact analysis
• Legal commentators note the complexity of distinguishing between activities requiring consent vs. those covered by business activities or socially beneficial purposes, which can create uncertainty and compliance risk.Legislative Summary – Parliament of Canada American Bar Association analysis

• Data mapping for rights (access, erasure, portability)
• Moving from PIPEDA to CPPA requires more granular data inventories, especially to support erasure and portability, which many organizations lack.IAPP overview of Bill C‑27 [Legislative Summary – Parliament of Canada](

Recent developments

• 2026-06-15 — The federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, as the successor to Bill C-27. (source)
• 2025-01-06 — Prorogation of Parliament on January 6, 2025 halted all legislative progress on Bill C-27, including clause‑by‑clause review at the INDU Committee, effectively freezing the CPPA’s advance and requiring the government to decide whether and how to reintroduce privacy reform.[7] (source)
• 2024-12-10 — Parliament’s legislative summary of Bill C‑27 (CPPA, Tribunal Act and AI Act) continued to be updated and referenced through late 2024, outlining stronger enforcement powers, administrative monetary penalties, data portability and algorithmic transparency provisions that businesses were preparing to address in compliance programs.[9] (source)
• 2024-11-20 — The Department of Justice Charter statement on Bill C‑27 remained the federal government’s key policy explanation of how the CPPA would replace PIPEDA’s Part 1 and create a new regime for collection, use and disclosure of personal information, including tribunal‑imposed administrative monetary penalties.[1] (source)
• 2024-10-30 — Parliament’s LEGISinfo page for Bill C‑27 continued to record the bill as being at House of Commons committee stage (after second reading on April 24, 2023), signaling that despite growing uncertainty about its future, CPPA remained the central vehicle for federal private‑sector privacy reform.[3] (source)
• 2024-10-15 — Legal commentary for businesses emphasized that the CPPA under Bill C‑27 would introduce significantly higher penalties (up to 3% of global revenue or C$10M administratively, and up to 5% or C$25M on conviction) and new rights such as disposal and mobility, prompting organizations to reassess risk and governance frameworks in anticipation of eventual enactment.[6] (source)
• 2024-09-30 — Industry analysis continued to highlight CPPA’s alignment with GDPR‑style concepts (legitimate interest, enhanced consent, privacy management programs, and AI‑related rules), with privacy counsel advising clients to treat these elements as a likely baseline for future Canadian federal privacy compliance even amid legislative delays.[4] (source)
• 2024-09-15 — Commentary on “CPPA 2.0” described Bill C‑27’s strengthened protections for children’s personal information, express recognition of “legitimate interest” exceptions, and explicit exclusion of anonymized data, noting that these features were shaping industry expectations and children‑focused data practices despite the bill not yet being law.[8] (source)
• 2024-09-01 — Business‑law guidance for multinational companies framed CPPA under Bill C‑27 as moving Canadian privacy law closer to the EU GDPR and Québec’s Law 25, leading organizations operating in Canada to plan for more rigorous consent, privacy program, breach response and automated decision‑making obligations.[5] (source)
• 2024-08-20 — A widely circulated video commentary argued that Bill C‑27’s CPPA was effectively “dead” after prorogation, sparking industry debate about whether federal privacy reform would be restarted with a new bill and reinforcing short‑term reliance on PIPEDA as the operative regime.[2] (source)
• 2024-08-10 — Privacy practitioners reported that, in light of CPPA’s stalled status, many organizations were still proactively adopting CPPA‑style measures (enhanced accountability, privacy management programs, and children’s data safeguards) to future‑proof operations and align with evolving Canadian and global privacy norms.[7] (source)

Related regulations

• Artificial Intelligence and Data Act — Canada, Superseded
• Canada Critical Cyber Systems Protection Act (Bill C-8) — Canada, Phased
• Canada Protecting Privacy and Consumer Data Act (Bill C-36) — Canada, Proposed
• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01

Put it into practice

• Generate the policy: PIPEDA policy generator (generatepolicy.com)
• Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
• Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates