Canada PIPEDA and Bill C-27: Duties and Reform Status

Canada's federal private-sector privacy law is still PIPEDA, because Bill C-27 died on the Order Paper in January 2025 and its successor, Bill C-36, had only completed first reading by October 2026. Many compliance plans written between 2022 and 2024 assumed the Consumer Privacy Protection Act would be in force by now, with tribunal-imposed penalties and AI rules. It is not. The duties that apply today are PIPEDA's ten fair information principles, the breach reporting regime in Division 1.1 and the Breach of Security Safeguards Regulations, which require a record of every breach for 24 months. This guide covers scope, obligations, reform status, enforcement, what the rules mean for AI agents and machine credentials, and a compliance plan. It is for security, privacy and engineering leads at organisations handling personal information of people in Canada. For the cross-jurisdiction picture, see the Global Privacy Regulatory Map.

Key takeaways

PIPEDA is the law today: the Justice Laws text is current to 30 September 2026 and was last amended on 4 March 2025; Bill C-27 lapsed on prorogation on 6 January 2025.
Bill C-36 is the new reform bill: the Protecting Privacy and Consumer Data Act was introduced on 15 June 2026 and LEGISinfo shows it at second reading in the House of Commons, with no second reading activity recorded.
Report on real risk of significant harm: breaches that create a real risk of significant harm must be reported to the Privacy Commissioner and notified to individuals as soon as feasible.
Record every breach for 24 months: including breaches below the reporting threshold, with enough detail for the Commissioner to verify compliance.
Quebec is different: Law 25 adds incident notification, a register, transfer impact assessments, automated decision notices and administrative penalties of up to $10 million or 2% of worldwide revenue.

Scope: who and what is covered

Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) applies to personal information an organisation collects, uses or discloses in the course of commercial activities, and to employee and applicant information held by federal works, undertakings or businesses (s. 4(1)). Personal information means information about an identifiable individual (s. 2(1)).

Situation	Applicable law	Source
Commercial activity in a province without a substantially similar law	PIPEDA	s. 4(1)
Commercial activity wholly within Alberta, British Columbia or Quebec	Provincial private-sector law (deemed substantially similar), generally instead of PIPEDA	s. 26(2)(b); OPC
Personal information crossing provincial or national borders in commercial activity	PIPEDA, even if the business is in AB, BC or QC	OPC
Federally regulated businesses (banks, airlines, airports, telecoms, broadcasters, interprovincial transport)	PIPEDA, including for employee information	s. 4(1)(b); OPC
Organisations in Yukon, Northwest Territories, Nunavut	PIPEDA (treated as federally regulated)	OPC
Federal government institutions	Privacy Act, not PIPEDA	s. 4(2)
Business contact information used solely to communicate about employment, business or profession	Excluded	s. 4.01

Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador also have health information laws that apply to health custodians. Personal and domestic use, and purely journalistic, artistic or literary purposes, are excluded (s. 4(2)).

Key obligations

The ten principles

Section 5 requires compliance with Schedule 1, the CSA Model Code for the Protection of Personal Information (CAN/CSA-Q830-96). "Should" in Schedule 1 is a recommendation, "shall" is an obligation (s. 5(2)), and any collection, use or disclosure must be for purposes a reasonable person would consider appropriate (s. 5(3)).

Principle	What it requires	Security team relevance
4.1 Accountability	Named individuals responsible; organisation remains responsible for information passed to a third party for processing, using contracts or other means (4.1.3)	Vendor and cloud contracts, processor oversight
4.2 Identifying purposes	Purposes identified at or before collection	Telemetry and log purposes documented
4.3 Consent	Knowledge and consent, with exceptions; valid only if the individual would understand nature, purpose and consequences (s. 6.1)	Exceptions in s. 7 for some security and legal needs
4.4 Limiting collection	Only what is needed, by fair and lawful means	Minimise fields in logs and datasets
4.5 Limiting use, disclosure and retention	Delete, destroy or anonymise when no longer needed (4.5.3)	Retention schedules, backups, test data
4.6 Accuracy	Accurate enough for the purpose	Identity data quality
4.7 Safeguards	Security appropriate to sensitivity: physical, organisational (need to know), technological (passwords, encryption); safe disposal	Core control set
4.8 Openness	Policies readily available	Public privacy notice
4.9 Individual access	Access to and correction of personal information	Ability to find a person's data across systems
4.10 Challenging compliance	Complaint handling	Escalation route from support to privacy office

Breach reporting, notification and records

Division 1.1 of PIPEDA and the Breach of Security Safeguards Regulations (SOR/2018-64) set the incident duties.

Duty	Rule	Source
Threshold	Reasonable to believe the breach creates a real risk of significant harm (RROSH) to an individual	s. 10.1(1)
Significant harm	Bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on credit record, damage to or loss of property	s. 10.1(7)
Real risk factors	Sensitivity of the information, probability it has been, is being or will be misused, any prescribed factor	s. 10.1(8)
Report to Commissioner	In writing, as soon as feasible after determining the breach occurred: circumstances and cause, date or period, information involved, number of individuals, mitigation steps, notification steps, contact person; updates allowed	s. 10.1(2); Regs s. 2
Notify individuals	As soon as feasible, conspicuous, with circumstances, timing, information involved, steps taken, steps individuals can take, contact details	s. 10.1(3)-(6); Regs s. 3
Direct or indirect notice	Direct (in person, phone, mail, email) unless direct notice would cause further harm or undue hardship, or contact details are missing; then public communication	Regs ss. 4-5
Notify other organisations	Those that may reduce or mitigate harm (for example, a card issuer or police)	s. 10.2
Breach record	Every breach of security safeguards, kept 24 months after the day the organisation determines it occurred, with enough information for the Commissioner to verify compliance; provided on request	s. 10.3; Regs s. 6

Two practical points. First, there is no fixed hour count: "as soon as feasible" is judged on the facts, so a documented decision timeline matters more than a clock. Second, the record covers every breach, not only reportable ones, which means your RROSH assessment for a low-risk incident is itself evidence. For a multi-jurisdiction workflow, see the Data Breach Notification Checklist and the Breach Notification Laws by Country Guide.

Timeline and current status

Date	Event
2000	PIPEDA enacted (S.C. 2000, c. 5)
1 November 2018	Mandatory breach reporting and record keeping in force
17 November 2020	Bill C-11 (Digital Charter Implementation Act, 2020) first reading
15 April 2021	Bill C-11 dies on dissolution of Parliament
16 June 2022	Bill C-27 (Digital Charter Implementation Act, 2022) first reading
6 January 2025	Parliament prorogued; Bill C-27 dies on the Order Paper during committee study
4 March 2025	Latest amendment to the consolidated PIPEDA text
15 June 2026	Bill C-36 (Protecting Privacy and Consumer Data Act) introduced and read a first time, sponsored by the Minister of Artificial Intelligence and Digital Innovation
October 2026	Bill C-36 at second reading stage in the House of Commons; no second reading debate recorded on LEGISinfo

What changed between C-27 and C-36

Bill C-27 would have enacted the Consumer Privacy Protection Act, a Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act (AIDA). According to DLA Piper's analysis of the tabled text, Bill C-36 is narrower:

Privacy only: the Protecting Privacy and Consumer Data Act (PPCDA) would replace PIPEDA Part 1. AIDA and the tribunal are dropped.
New regulator structure: privacy oversight would sit in a Digital Safety and Data Protection Commission of Canada, building on the Digital Safety Commission proposed in Bill C-34, and coming into force depends on that bill.
Penalties without a tribunal: administrative monetary penalties up to $10 million or 3% of global revenue, and fines on indictment up to $25 million or 5%, whichever is higher.
Carried forward: breach notification, consent rules and data mobility; de-identified data stays personal information and re-identification is prohibited with limited exceptions.
Automated decision systems: disclosure duties for systems that could have a legal or similarly significant effect on individuals.
Children: a higher standard for minors' information, and a private right of action once a contravention is established.

Status as of October 2026: none of this is law. Plan on PIPEDA today, and treat C-36 as a design target for programmes with a multi-year horizon. Check LEGISinfo before relying on this section, because bill stages move quickly once debate starts. AI governance after AIDA is covered in the Canada AI Regulation Guide (post-AIDA).

Quebec Law 25 in brief

Quebec's Law 25 amended its private-sector privacy law in three phases: September 2022, September 2023 (most obligations, including a published person in charge of personal information, governance policies, privacy impact assessments before transfers outside Quebec and stricter consent) and September 2024 (data portability). Businesses must notify the Commission d'accès à l'information and affected people of confidentiality incidents presenting a risk of serious injury, and keep an incident register. Individuals must be told of decisions based exclusively on automated processing and given the chance to have a person review them. Biometric databases must be disclosed to the CAI at least 60 days before use. A business in Quebec that also transfers data across borders may face both PIPEDA and Law 25, so build one incident workflow that meets both thresholds.

Enforcement and penalties

Complaints and investigations (ss. 11-13): individuals may complain to the Privacy Commissioner, who can also initiate a complaint. The Commissioner can compel evidence, enter non-residential premises and attempt mediation, and must report within one year of the complaint.
No order-making or penalty power: under PIPEDA the Commissioner issues findings and recommendations. Enforcement runs through the Federal Court.
Federal Court (ss. 14-16): within one year of the report, a complainant may apply to the Federal Court, which can order changes to practices, require published corrective notices and award damages, including for humiliation.
Offences (s. 28): knowingly contravening s. 8(8), s. 10.1 (breach reporting and notification), s. 10.3(1) (breach records) or s. 27.1(1), or obstructing an investigation or audit, is an offence: up to $10,000 on summary conviction and $100,000 on indictment.

What this means for security teams: the breach record is the one place where PIPEDA has criminal teeth. A missing or incomplete 24-month record, or a knowingly unreported RROSH breach, is the most likely route to prosecution, and the facts the Commissioner reviews will come from your incident tickets.

What it means for AI agents and non-human identities

Credentials are part of safeguards: principle 4.7 names passwords and encryption as technological safeguards. Service account passwords, API keys and OAuth tokens that reach personal information are the modern equivalent and need ownership, scoping, rotation and vaulting. See the Secrets Management Guide.
Leaked machine credentials can meet RROSH: if a key exposed in a repository opened a database of customer records, the probability of misuse depends on whether it was used. Log enough to answer that quickly. The Snowflake breach shows how valid credentials without MFA, never rotated, became a mass data theft across customer tenants.
Accountability does not transfer to a model provider: principle 4.1.3 keeps the organisation responsible for information it gives a third party for processing, which includes LLM and agent platforms. Contracts should cover retention, training use, sub-processing and breach notice.
The organisation owns what its bots say: in Moffatt v. Air Canada the British Columbia Civil Resolution Tribunal rejected the argument that a chatbot was a separate entity. It is a consumer law case, not a privacy ruling, but the reasoning applies to agents acting for you. See the Air Canada chatbot ruling.
Regulators' generative AI expectations: the federal, provincial and territorial privacy commissioners' December 2023 principles for generative AI ask organisations to mitigate prompt injection, model inversion and jailbreaking, to test for training data extraction, to run privacy and algorithmic impact assessments, and to provide human review of decisions. See the AI Impact Assessment Template.

Framework mapping

PIPEDA requirement	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Accountability, processors (4.1, 4.1.3)	GV.OC-03	SA-9	A.5.19, A.5.20
Purposes and consent (4.2, 4.3)	GV.OC-03	PT-2, PT-3, PT-5	A.5.34
Retention and disposal (4.5.3)	ID.AM-07	SI-12	A.8.10
Safeguards (4.7)	PR.DS-01, PR.AA-05	AC-6	A.8.2, A.8.24
Breach reporting and notification (s. 10.1, 10.2)	RS.CO-02, RS.CO-03	IR-6, IR-8	A.5.24, A.5.26
24-month breach record (s. 10.3)	RS.CO-02	AU-11, SI-12	A.5.28
Impact assessment (OPC AI principles, Law 25)	GV.OC-03	RA-8	A.5.34

Compliance steps

Decide which law applies: map each processing activity to PIPEDA, Alberta or BC PIPA, Quebec's private-sector law or a health law, using the scope table. Cross-border flows default to PIPEDA.
Name the accountable person and publish the privacy policy and contact (4.1, 4.8).
Inventory personal information and the identities that reach it: human users, service accounts, API keys and AI agents, with purpose and retention for each.
Write the RROSH procedure: a scoring template using sensitivity and probability of misuse, the s. 10.1(7) harm list, a named decision owner and a target for "as soon as feasible" (for example, decision within 72 hours of containment, report the same day).
Build the breach record: one entry per breach with date determined, cause, information involved, individuals affected, RROSH reasoning and notifications made; set retention to at least 24 months from determination.
Prepare notices: templates matching Regulations ss. 2 and 3, and an indirect notice option for missing contact details.
Fix processor contracts: breach notice to you, safeguards, sub-processing, retention and AI training use.
Add Quebec requirements if you operate there: incident register, transfer PIAs and automated decision notices.
Test and refine: run a tabletop on a leaked API key and a vendor breach; check that the record and the report could both be produced from the tickets.
Track C-36: review gaps against its automated decision and children's provisions once it passes second reading.

Small versus large organisations: PIPEDA has no size threshold. A small business can meet the core duties with a single accountable person, a retention schedule, a short RROSH template and a spreadsheet breach log. A large or multi-provincial organisation needs a consolidated incident workflow that applies PIPEDA, Law 25 and other jurisdictions in parallel, with legal sign-off on each threshold decision.

Detection and measurement

Time from detection to RROSH decision and from decision to Commissioner report.
Percentage of breaches with a complete record entry within five working days of determination (target: 100%).
Proportion of processors with breach notice terms and a named contact.
Machine credentials with access to personal information that have an owner and rotation date.
Access requests completed within the statutory response period (30 days under PIPEDA s. 8(3), subject to extensions).

Common failure patterns

Planning for the CPPA: programmes built for Bill C-27 still reference a tribunal and penalties that do not exist; the live duties are PIPEDA's.
Logging only reportable breaches: the s. 10.3 record must cover every breach of security safeguards, including low-risk ones.
Dropping records too early: the 24 months run from the day the breach was determined, not from the incident date.
Ignoring the vendor breach: a processor's incident involving your customers' information is your breach to assess under principle 4.1.3.
Dismissing machine credential leaks: a token with read access to personal information is treated as "no data exposed" without checking access logs.
Forgetting Quebec: PIPEDA compliance does not satisfy Law 25's register, PIA and automated decision duties.

Practitioner checklist

Confirm for each processing activity whether PIPEDA or a provincial law applies.
Publish the accountable person and privacy policy.
Document an RROSH assessment method using s. 10.1(7) and (8).
Keep a breach record for every breach, retained 24 months from determination.
Pre-approve Commissioner report and individual notice templates.
Put breach notice, safeguards and AI training terms in every processor contract.
Vault, scope and rotate machine credentials that reach personal information.
Run privacy and algorithmic impact assessments before deploying generative AI or agents.
Track Bill C-36 on LEGISinfo each quarter.

Standards and references

This guide summarises PIPEDA, the Breach of Security Safeguards Regulations and the status of federal privacy reform as of October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Privacy Regulatory Map · Canada AI Regulation Guide (post-AIDA) · Data Breach Notification Checklist · Brazil LGPD Guide

Canada PIPEDA and Bill C-27 Guide: Privacy Duties, Breach Records and Reform Status