Canada's New Privacy Bill Is Here
What This Means for Your Organization
- July 06, 2026
- 3 min read
Privacy thinking, straight from the people building the programs.
From evolving regulations to everyday privacy challenges, we provide clear, actionable insights on Canadian and global privacy issues. Explore expert perspectives designed to help organizations operationalize responsible data practices, manage risk confidently, and turn data protection into a business advantage.
Here are the highlights of what you need to know.
Whom Does this Apply to?
If your organization collects, uses, or discloses personal information in the course of commercial activities, the proposed PPCDA could significantly impact how you manage, protect, retain, and transfer that information. Now is the time to understand what these changes could mean for your organization.
Your Privacy Program Needs to Be Real
Organizations will be required to have a formal, documented privacy management program, not just a policy that lives on an intranet. It needs to cover how you protect personal information, handle complaints, and train your people. The scope scales with the volume and sensitivity of the data you handle, so not every organization faces the same burden.
Keeping Data Forever Is No Longer an Option
Retention is now a statutory obligation, not just a best practice. You cannot retain personal information longer than necessary; once the purpose is fulfilled, you need to dispose of it. Individuals also get a new right to request deletion of their information in certain circumstances. If your organization doesn’t have a retention schedule, now is the time to build one.
Sending Data Across Borders Just Got More Complicated
If your organization sends personal information outside Canada to cloud providers, affiliates, or service partners, you will need to conduct a privacy impact assessment. This is a new obligation, so for some organizations, this may be a whole new process to build.
De-identification and Anonymization Are Not the Same Thing Anymore
C-36 draws a clear legal line between two terms that have often been used interchangeably. De-identified information remains personal information. Anonymized information falls outside the Act entirely. Organizations using de-identification need to apply proportionate technical and administrative safeguards. If de-identification is part of your data-sharing or compliance strategy, this matters.
Children's Information Gets Special Protection
C-36 defines “child” as anyone under 18 and treats their personal information as sensitive by definition. If minors could use your products or services, this change is directly relevant to you.
The Need to Be More Transparent
Plain-language transparency obligations are significantly expanded. Organizations will need to clearly disclose what personal information they hold, how they use it, whether they transfer it outside Canada, and whether they use automated decision systems that could meaningfully affect individuals. The automated systems disclosure is new territory for many organizations.
Expanded Definition of Personal Information
The definition of personal information under Bill C-36 is expanded. It now includes information inferred about an identifiable individual, which, in a digital world, greatly expands the scope.
A New Regulator - With Teeth
One of the most notable shifts in C-36 is the move away from the Office of the Privacy Commissioner of Canada’s ombudsman model to a new Digital Safety and Data Protection Commission. Unlike the current regime, this Commission can impose fines of up to the greater of $10 million or 3% of gross global revenue per investigation.
So What Now?
C-36 isn’t law yet, but the compliance work ahead is real, and it takes time to do properly.
A few things worth thinking about now:
Where do you stand against the PPCDA framework?
Do you have a privacy impact assessment process?
Are your consent structures up to date?
Do you have a privacy management program that would hold up to scrutiny?
Garabyte works with organizations to turn these questions into practical answers. Whether you are building on an existing program or starting from scratch, get in touch to talk through where you stand and what makes sense for your organization.
