What is changing, and what is not law yet
Canadian privacy law is being rewritten in more than one place at once. These guides say what each proposal would do and, as plainly as possible, which parts are in force today and which are a Bill that has not passed.
Cross-Border Privacy Impact Assessments Under Bill C-36 (PPCDA): Which Vendors Trigger the Requirement
PPCDA requires a Privacy Impact Assessment before transferring personal data outside Canada, any organization using US cloud vendors will trigger it.
PPCDA
Legitimate Interest Under Bill C-36 (PPCDA): New to Canadian Privacy Law
Bill C-36's PPCDA introduces legitimate interest, a new basis to use personal information without consent that does not exist under PIPEDA.
PPCDA
Bill C-36 (PPCDA): Canada's New Privacy Law Lets Customers Sue You Directly
PPCDA lets individuals sue for privacy violations after a confirmed OPC finding, direct liability that does not exist under PIPEDA.
PPCDA
What Is a Privacy Management Program Under Bill C-36 (PPCDA)?
Bill C-36's PPCDA makes a documented privacy management program mandatory, organizations without one will be in breach of the new law.
PPCDA
Alberta PIPA Reform: What the 12 Recommendations Mean for Your Business
Alberta's Standing Committee recommended 12 PIPA amendments, new enforcement powers, a defined harm threshold, and mandatory vendor contracts.
AB PIPA
BC PIPA Reform: What BC's 2026 Privacy Bill Signals for Private-Sector Businesses
BC is reforming its public-sector privacy law first. What Bill 9 signals for BC PIPA private-sector reform, and what to do now.
BC PIPA
What Is Bill C-36? Canada's New Privacy Law for Small Businesses
Bill C-36 replaces PIPEDA with the PPCDA, breach reporting is unchanged, but privacy management programs and legitimate interest are new.
PPCDA