Bill C-36: what Canada’s proposed privacy law would change for you

On June 15, 2026, the federal government introduced Bill C-36, which would create the Protecting Privacy and Consumer Data Act (PPCDA) and replace the privacy part of PIPEDA, the law that has governed how Canadian businesses handle personal information for more than two decades. The government calls it “the most significant change to Canada’s private-sector privacy law in over 25 years.”

It isn’t law yet. As of this writing, LEGISinfo lists it at second reading in the House of Commons, with no committee study yet. The last attempt, Bill C-27, died when Parliament was prorogued in January 2025. So read this as what’s proposed, not what’s settled.

What it would give you

According to the government’s backgrounder, the PPCDA would:

• recognize privacy as a fundamental right
• hold organizations to a higher standard for children’s information
• require meaningful consent and clearer explanations of how your information is used
• add transparency about automated decisions, including ones made by AI
• let you request deletion or disposal of your personal information “in certain circumstances”
• support data mobility, so you can move your information between organizations where a framework exists
• address unfair uses of personal information, naming “inappropriate surveillance pricing” as an example

The deletion right is the one most people will feel. Today, PIPEDA lets you see and correct what a company holds about you, but there’s no general federal right to make it delete your data. Quebec already went further with Law 25. How useful the federal version is will depend on the “certain circumstances,” and those details are in the bill text and future regulations, not the summary.

A regulator that can give orders

Under PIPEDA, the Privacy Commissioner can investigate and recommend, but can’t order a company to do anything. To enforce a finding, the Commissioner has to go to Federal Court. That is exactly what happened in August 2026, when the Commissioner applied to the Federal Court to make Google implement a de-listing finding it had declined to follow.

C-36 would create a Digital Safety and Data Protection Commission of Canada, with a dedicated Privacy and Consumer Data Commissioner inside it, able to issue binding orders. The backgrounder lists penalties of up to $10 million or 3% of global revenue, and fines of up to $25 million or 5% for the most serious offences, whichever is greater in each case.

Data leaving Canada

The bill would also require organizations to assess and mitigate privacy risks before sending personal information outside Canada, and to consider privacy when choosing service providers. For anyone who cares where their data is stored, that’s a meaningful change from today’s mostly contract-based approach.

What doesn’t change yet

Until C-36 passes and comes into force, PIPEDA still applies. That means:

• Companies must report breaches that create a real risk of significant harm, and tell you about them.
• You can ask any company what it holds about you, and it generally has 30 days to answer.
• In Quebec, Law 25’s stronger rights, like de-indexing and data portability, already apply.

Why we care

Frame is built in Canada and keeps data in Canada. We already follow the spirit of what C-36 proposes: you can delete your account and data yourself, see what we hold, and choose how long we keep it. We’ll follow the bill as it moves and update this post when it does.

Sources

• Parliament of Canada, LEGISinfo: C-36 (45-1)
• Innovation, Science and Economic Development Canada, Backgrounder: Government of Canada introduces legislation to Protect Canadians’ Privacy in the Digital Age, June 15, 2026
• Fasken, Prorogation’s Digital Impact: Canada’s Digital Bills Set to Die on the Order Paper, January 2025
• Office of the Privacy Commissioner of Canada, Notice of application filed with Federal Court in connection with search engine de-listing investigation, August 28, 2026
• Office of the Privacy Commissioner of Canada, PIPEDA Principle 9: Individual Access