Protecting Privacy and Consumer Data Act (Bill C-36)
Bill — not yet law
Canada
· 2026
Tabled 15 June 2026, Bill C-36 is Canada's third attempt to replace PIPEDA — after Bill C-11 died in 2020 and Bill C-27 died on prorogation in January 2025. It would create a new Digital Safety and Data Protection Commission with order-making power and administrative penalties to the greater of CAD 25 million or 5% of gross global revenue, and regulate automated decision systems through the privacy frame rather than through a separate AI act. It is a bill and binds no one yet.
This is a bill, not law. It has been introduced but not enacted, it can be
amended beyond recognition or die on the order paper, and nothing in it binds anyone today.
It is catalogued because the obligations it proposes are the ones worth building toward.
Horizontal regime. It binds companies by what they do with data, software or
customers, not by the sector they sit in. The industries below are where it creates
specific, additional duties — not the limit of who has to comply.
Regions
Industries
Each links to that industry as a scored cohort — so the question "how ready is this sector for the regime that governs it?" becomes one you can actually look at.