Ryan MacDonaldTL;DR: Bill C-27 — Canada's Digital Charter Implementation Act — packages two landmark pieces of legislation into a single statute: the Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA). Together they replace the outdated Personal Information Protection and Electronic Documents Act (PIPEDA), establish enhanced individual privacy rights, and create Canada's first federal framework for regulating high-impact artificial intelligence systems. Businesses that collect personal data, develop AI tools, or automate decisions affecting Canadians face new mandatory compliance obligations, privacy management programs, and penalties reaching up to $25 million or 5% of global annual revenue — whichever is greater.
What Bill C-27 Actually Contains
Bill C-27, formally titled the Digital Charter Implementation Act, 2022, was introduced in the House of Commons in June 2022 and represents the most significant overhaul of Canadian data law in more than two decades. The bill combines three pieces of legislation into one package:
- Consumer Privacy Protection Act (CPPA) — replaces PIPEDA and modernizes individual privacy rights for all commercial contexts.
- Artificial Intelligence and Data Act (AIDA) — establishes Canada's first federal framework specifically targeting high-impact AI systems.
- Personal Information and Data Protection Tribunal Act (PIDPTA) — creates an independent enforcement tribunal empowered to impose administrative monetary penalties.
Unlike PIPEDA, which applied narrowly to organizations in commercial activity across provincial borders, CPPA applies more broadly and introduces a compliance structure closer to Europe's General Data Protection Regulation (GDPR). AIDA has no legislative predecessor in Canadian history — it is a first-of-its-kind statute that positions Canada among the early movers on national AI governance alongside the EU AI Act.
The full legislative text of Bill C-27 is publicly available on the Parliament of Canada website and continues to evolve through Senate committee review.
Understanding Bill C-27 as a package is critical. Compliance teams that treat CPPA and AIDA as separate workstreams risk missing the overlapping obligations that apply when personal data feeds into AI systems — which is the norm, not the exception, for most modern Canadian businesses.
CPPA: Canada's New Privacy Standard
The Consumer Privacy Protection Act resets the baseline for how Canadian businesses must handle personal information. The most consequential changes from PIPEDA include four areas that require immediate attention.
Meaningful consent. Under CPPA, consent must be meaningful — organizations must communicate clearly what data is collected, how it will be used, and to whom it may be disclosed. Implied consent is substantially narrowed; explicit consent is required for sensitive data categories including health information, financial data, and biometric identifiers.
Right to disposal. Individuals gain the right to request deletion of personal information that is no longer necessary for the purpose for which it was collected. Organizations must confirm disposal within a defined timeframe and update retention schedules accordingly.
Data portability. CPPA introduces a right to data portability, allowing individuals to request their information in a machine-readable format for transfer to another organization. This mirrors GDPR Article 20 and will require businesses to invest in interoperable data architecture — particularly challenging for organizations running legacy systems.
Privacy management programs. Every organization subject to CPPA must establish and maintain a documented privacy management program — a risk-based internal policy framework covering data inventories, breach response procedures, retention schedules, and staff training. This is not optional guidance; it is a compliance obligation.
AIDA: Canada's First Federal AI Regulation
The Artificial Intelligence and Data Act is the portion of Bill C-27 that has drawn the most attention from technology companies, civil liberties advocates, and international regulators. AIDA creates obligations for organizations that design, develop, or deploy "high-impact AI systems" — a category defined through regulation rather than in the statute itself, meaning precise thresholds will be finalized by the federal government after the bill receives Royal Assent.
To understand what artificial intelligence systems actually do at a technical level helps contextualize why AIDA's obligations are structured around outcomes rather than algorithms.
What Qualifies as a High-Impact AI System?
Draft guidance from Innovation, Science and Economic Development Canada (ISED) suggests systems are likely classified as high-impact when they:
- Make or materially influence decisions about individuals in areas such as employment, credit, housing, or healthcare
- Operate critical infrastructure or public safety services
- Generate content that could deceive or manipulate at scale — including synthetic media and deepfakes
Key Obligations for Covered Organizations
For businesses operating high-impact systems, AIDA imposes three categories of obligation:
Risk assessment. Before deploying a high-impact system, organizations must conduct and document a risk assessment identifying potential harms — physical, psychological, financial, and reputational — to individuals who may be affected by the system's outputs or decisions.
Monitoring and record-keeping. High-impact AI systems must be continuously monitored for performance and bias. Organizations must retain records sufficient to demonstrate compliance with AIDA's risk mitigation requirements and make those records available to the responsible minister on request.
Transparency. Businesses must disclose when a high-impact AI system has made or assisted a consequential decision affecting an individual, and provide a meaningful explanation of the factors the system considered. Algorithmic transparency is no longer optional for covered systems.
A critical distinction from CPPA: AIDA penalties extend to criminal liability. Wilful violations that cause harm to individuals carry potential imprisonment — a signal that Canada's legislature views irresponsible AI deployment as a public safety issue, not merely a regulatory compliance matter.
How AIDA and CPPA Interact in Practice
The most complex compliance challenge Bill C-27 creates is not CPPA or AIDA in isolation — it is their intersection. Both statutes govern how organizations handle data, but from different angles and with overlapping obligations that can compound when personal data feeds into AI systems.
Consider a common scenario: a Canadian financial services firm uses a machine learning model to evaluate loan applications based on credit history, income, and transaction data. Under CPPA, the firm must obtain valid consent for collecting and using that personal data, disclose that AI is involved in the decision-making process, and give applicants the right to request a human review. Under AIDA, because the system makes consequential financial decisions, it almost certainly qualifies as a high-impact system — triggering mandatory risk assessment, continuous monitoring, and transparency obligations that go beyond what CPPA alone requires.
Data Minimization as a Shared Principle
Both statutes expect organizations to limit data use to what is necessary for a defined purpose. CPPA codifies this as a consent condition; AIDA's risk assessment framework builds it into the mitigation requirement. In practice, organizations that architect data minimization into their AI pipeline design satisfy obligations under both statutes simultaneously — reducing both privacy risk and AI harm risk.
Privacy by Design Under Dual Obligations
CPPA encourages — and may require — privacy-by-design approaches for systems that process significant volumes of personal data. Organizations building AIDA-compliant AI systems should embed privacy controls at the architectural level, not add them after deployment. Data inventories, purpose limitation clauses, and consent logs should be built into system design from the outset, not retrofitted during a compliance audit.
A unified compliance strategy — one data governance framework that maps obligations under both CPPA and AIDA to each data asset and AI system — is significantly more efficient than running separate workstreams for each statute.
Compliance Roadmap: Preparing Before Royal Assent
Organizations covered by Bill C-27 should not wait for Royal Assent to begin preparation. Privacy law transitions — including GDPR's 2018 enforcement date — consistently show that businesses starting compliance work late face rushed, expensive remediation and higher enforcement risk in the first year. Here is a structured roadmap for Canadian businesses:
Conduct a comprehensive data inventory. Map every category of personal information you collect, the legal basis for processing, retention periods, and third-party data sharing arrangements. This inventory is the foundation of your CPPA privacy management program and your AIDA risk assessment.
Classify your AI systems. Audit all AI tools currently in use or under development. For each system, document its inputs (does it use personal data?), outputs (does it affect individuals?), and use case (does it fall within ISED's draft high-impact categories?). Systems not currently high-impact may become so as they are enhanced or repurposed.
Update consent mechanisms. Review existing consent flows for PIPEDA compliance gaps. Where implied consent currently exists for data uses that CPPA will require explicit consent, redesign the user journey before the law takes effect. Retrofitting consent architectures is more expensive than building them correctly.
Build a breach response plan. CPPA introduces strengthened breach notification requirements — organizations must report breaches that create a real risk of significant harm both to the Office of the Privacy Commissioner of Canada (OPC) and directly to affected individuals. A documented, rehearsed response plan is not optional.
Engage qualified legal counsel. Bill C-27 is complex, and the regulations under AIDA are still being finalized through consultation. Outside counsel with expertise in both Canadian privacy law and AI governance can identify compliance gaps that internal teams may miss — particularly in the AIDA overlap with CPPA.
À retenir: Organizations with existing GDPR compliance programs have a meaningful head start. Many CPPA requirements mirror GDPR concepts — consent, purpose limitation, individual rights, breach notification. Conduct a gap analysis focused on where Canadian law diverges: particularly around AIDA, which has no direct EU equivalent at the federal level, and CPPA's specific right to disposal, which differs from GDPR's right to erasure in scope and procedure.
Canada's recent $705 million investment in sovereign AI computing infrastructure underscores that Ottawa sees AI regulation and AI investment as complementary — the regulatory framework exists to enable responsible adoption at scale, not to constrain innovation.
Penalties and Enforcement: What's at Stake
Bill C-27 creates an enforcement structure substantially more severe than anything under PIPEDA, which had a reputation among privacy lawyers as having paper-tiger penalties that did little to change corporate behaviour.
CPPA enforcement tiers:
| Violation type | Maximum penalty |
|---|---|
| Serious violations (e.g. unauthorized use, failure to safeguard) | $25,000,000 or 5% of global annual revenue |
| Standard violations (e.g. procedural non-compliance) | $10,000,000 or 3% of global annual revenue |
The Personal Information and Data Protection Tribunal (PIDPT), established under PIDPTA, hears appeals from OPC enforcement decisions and can impose administrative monetary penalties. For the first time, Canadian privacy law has a dedicated independent enforcement body modelled loosely on the UK Information Commissioner's Office (ICO).
AIDA enforcement:
- Administrative penalties: up to $25 million or 3% of global annual revenue for organizations
- Criminal penalties: up to two years' imprisonment for individuals who wilfully contravene AIDA and cause harm to individuals
The reputational dimension of AIDA enforcement should not be underestimated. ISED may publish the names of organizations found in violation — a form of public accountability ("naming and shaming") that has proven effective in other regulatory contexts and can cause lasting brand damage.
Canadian tech companies already navigate significant cross-border compliance pressure. The implications of diverging AI regulatory frameworks between Canada and the United States make building a proactive Canadian compliance posture even more strategically important for businesses operating in both markets.
Disclaimer: The information on this page is provided for informational purposes only and does not constitute legal advice. Consult a qualified lawyer or compliance specialist for guidance specific to your situation under Canadian law.
Frequently Asked Questions
What is the difference between CPPA and PIPEDA?
CPPA replaces PIPEDA as Canada's primary federal private-sector privacy law. It expands individual rights by adding data portability and the right to disposal, requires meaningful consent for all personal data uses rather than allowing implied consent, mandates formal privacy management programs, and creates a new enforcement tribunal — the PIDPT — with the authority to impose penalties of up to $25 million or 5% of global annual revenue. PIPEDA's penalty ceiling was $100,000 per violation, which most large organizations absorbed without meaningful behaviour change.
Does Bill C-27 apply to small businesses?
Yes. Unlike some regulatory frameworks that exempt small organizations, Bill C-27 does not establish a general small-business exemption under CPPA. All organizations that collect, use, or disclose personal information in the course of commercial activity are subject to the Act. Small businesses handling sensitive personal data categories — including health information, financial data, or biometric identifiers — face the same consent and program obligations as large enterprises, though the OPC has historically taken a risk-proportionate approach to enforcement.
What makes an AI system "high-impact" under AIDA?
The precise definition will be set by federal regulation after Bill C-27 receives Royal Assent. Based on draft guidance from Innovation, Science and Economic Development Canada (ISED), high-impact systems are those that make or materially influence consequential decisions about individuals in domains such as employment, credit, housing, or healthcare; operate in public safety or critical infrastructure contexts; or generate deceptive synthetic content at scale. The regulatory definition will be binding — organizations should monitor ISED's consultation process.
When will Bill C-27 come into force?
As of 2026, Bill C-27 remains before Parliament. Senate committee review has included substantial proposed amendments, particularly to AIDA's scope and definitions. Businesses should monitor the Office of the Privacy Commissioner of Canada (OPC) and ISED for proclamation announcements. Compliance preparation should proceed now — waiting for Royal Assent reduces the time available for remediation and increases enforcement risk in the law's initial application period.
What is the best first step for a business starting CPPA compliance?
Conduct a comprehensive personal data inventory. Without knowing exactly what personal information your organization collects, stores, processes, and shares — and on what legal basis — you cannot design compliant consent mechanisms, implement appropriate retention schedules, or prepare a meaningful breach response procedure. The inventory also forms the foundation of the privacy management program CPPA requires and provides the data asset map that AIDA risk assessments need. Start there, then layer consent, rights management, and AI governance on top.
