Bill C-36 explained: Canada's proposed privacy law and what it means for your software

What happened, and where does Bill C-36 stand?

Bill C-36 was introduced and given first reading in the House of Commons on 15 June 2026. Its sponsor is Evan Solomon, Minister of Artificial Intelligence and Digital Innovation. Parliament rose on 18 June 2026 and returned on 21 September 2026, with second reading expected in the fall sitting.

We could not open the Parliament of Canada's LEGISinfo page directly when checking, so the status above is taken from openparliament.ca and from Gowling WLG's analysis, both of which show the bill awaiting second reading. Check LEGISinfo for the current stage. No coming-into-force date has been set, and the bill would need to pass both the House and the Senate first.

Who would Bill C-36 affect?

Bill C-36 would apply to organizations that collect, use or disclose personal information in the course of commercial activities, which is the same broad group PIPEDA covers today. It would not apply to federal government institutions, which have their own law.

• Any business that holds customer, patient, member or client records, whatever its size. The bill scales some duties, such as the privacy management program, to the volume and sensitivity of the information.
• Businesses that use software to make or support decisions about people, such as credit, pricing, eligibility, hiring screens or fraud flags.
• Businesses whose software or vendors store or process personal information outside Canada.
• Businesses that hold information about children. The bill defines a child as anyone under 18 and treats a child's personal information as sensitive.

Provinces with their own private-sector privacy law, such as Quebec, and provincial health privacy laws, such as Ontario's for health information custodians, add their own rules. How Bill C-36 would sit beside them is a question for your privacy counsel.

What would change compared with PIPEDA?

Bill C-36 would turn several general principles into specific duties, add new individual rights and give the regulator power to impose penalties. The main changes, as described by Blakes, Gowling WLG and BLG:

Law firm summaries differ on one detail: BLG names the regulator the Data Protection Commission of Canada in one place, while Blakes and Gowling WLG use Digital Safety and Data Protection Commission of Canada. The same commission would also oversee the proposed Digital Safety Act in Bill C-34.

What does Bill C-36 say about automated decisions and AI?

If your software makes a prediction, recommendation or decision about a person that has a legal or similarly significant effect, Bill C-36 would require you to publish a general account of that use and, on request, explain the specific result to the person affected. The person could also make written representations to a human reviewer.

Gowling WLG notes the definition covers everything from simple rules-based systems to neural networks. So this is not only about AI. A pricing rule, an eligibility check or a fraud score can all count if the effect on the person is significant.

Quebec businesses will recognize this. Quebec's private-sector privacy law, as amended by Law 25, already requires businesses to inform people of decisions based exclusively on automated processing, to give the information used and the main reasons on request, and to allow review by a person.

Bill C-36 is narrower on AI than Bill C-27 was. Blakes notes it does not include as comprehensive an AI framework as C-27, which also carried the proposed Artificial Intelligence and Data Act. Our AI adoption statistics show 13.7% of AI-using Canadian businesses already use AI decision-making systems, up from 5.7% a year earlier.

What penalties would Bill C-36 allow?

Bill C-36 proposes administrative monetary penalties of up to the greater of $10 million or 3% of gross global revenue in the preceding financial year. For the most serious offences, prosecuted on indictment, fines could reach the greater of $25 million or 5% of gross global revenue.

Knowingly breaking the breach-reporting duties is among the most serious offences, according to Gowling WLG. These are maximums; actual amounts would depend on the case and the final text of the law.

What would Bill C-36 mean for your software?

Most of Bill C-36's new duties need a system to carry them out. A policy that says you will delete data on request does not help if your database cannot find every copy.

None of this is unusual engineering, but it is much cheaper to build in than to add later. We cover each item, with the questions to ask a developer, in the privacy by design checklist. Health data has extra weight; see our digital health statistics for why patients and clinicians care.

What applies today while Bill C-36 is debated?

PIPEDA still applies. Until Bill C-36 passes and comes into force, the existing law and its breach rules are the ones you must follow.

• Report a breach to the Office of the Privacy Commissioner if it is reasonable to believe it creates a real risk of significant harm to an individual.
• Notify affected individuals, normally directly, and any organization or government institution that can reduce the harm.
• Keep a record of every breach of security safeguards, whether or not it meets the reporting threshold, for two years or longer if another law requires.

If your systems cannot already produce a breach record, that is the gap to close first, because it is required now. Our healthcare software guide and API integration guide cover how logging and access controls are usually built.

What to do now: a checklist

You do not need to rebuild anything for a bill that may still change. You do need to know where your gaps are, because the work takes months, not days.

1. 1Map where personal information lives: every database, spreadsheet, inbox, backup and vendor.
2. 2List every vendor and server outside Canada that receives personal information.
3. 3Find every place software makes or supports a significant decision about a person, and check whether you could explain one result today.
4. 4Test whether you could find and delete all records for one person in under a day.
5. 5Test whether you could export one person's data in a structured file.
6. 6Confirm you keep a record of every breach for two years. This is required under PIPEDA now.
7. 7Flag records about people under 18.
8. 8Ask your privacy counsel how Bill C-36 would interact with any provincial law that applies to you.

If two or more of those tests fail, the fix is usually in the software, not the policy. Book a free review and we will tell you which changes your current systems need, in plain language and in writing. We will update this page when Bill C-36 moves to second reading, committee or Royal Assent.