CanucktAI
HomeFrameworksCPPA / Bill C-27
PrivacyFederal, Canada (never in force)In force Never in force. Bill C-27 died on January 6, 2025

CPPA / Bill C-27

Consumer Privacy Protection Act (Bill C-27, Part 1, died January 2025)

The federal privacy reform bill that died before it became law

Overview

Bill C-27, including the Consumer Privacy Protection Act and AIDA, died on the order paper when Parliament was prorogued on January 6, 2025. It will never come into force. Its successor, Bill C-36, the Protecting Privacy and Consumer Data Act, was tabled on June 15, 2026 and is at second reading in the House of Commons. Bill C-36 is not law and does not create a Tribunal. PIPEDA remains the federal privacy law today. The points below describe what Bill C-27 proposed.

Authority
Office of the Privacy Commissioner of Canada, under PIPEDA, which remains in force
Jurisdiction
Federal, Canada (never in force)
Effective date
Never in force. Bill C-27 died on January 6, 2025
Applicability

Who must comply with CPPA / Bill C-27?

No one. Bill C-27 will never come into force, and organizations subject to PIPEDA remain subject to PIPEDA. Bill C-36 is not law; if Parliament passes it, its own coming into force rules will apply.

Compliance scope
Your organization collects personal information
You operate in the applicable jurisdiction
Commercial activities are involved
You use or disclose personal data

Not sure if CPPA / Bill C-27 applies? Run a free assessment →

Requirements

Key obligations under CPPA / Bill C-27

Algorithmic Transparency

Bill C-27 proposed a right to an explanation of automated decisions that significantly affect a person.

Withdrawal of Consent

Bill C-27 proposed that individuals could withdraw consent and have their information disposed of, with limited exceptions.

Data Portability

Bill C-27 proposed a right to have personal information transferred to another organization.

Disposal Obligation

Bill C-27 proposed a duty to dispose of personal information on request, with limited exceptions.

De-identification

Bill C-27 proposed rules on when de-identified information could be used.

Children's Privacy

Bill C-27 proposed treating the personal information of minors as sensitive.

Enforcement

Penalties & enforcement

Maximum penalty
Proposed only and never in force: offence fines up to the higher of $25M or 5% of gross global revenue (Bill C-27 s.128)
Enforced by: Administrative penalties would have been imposed by a new Tribunal (Bill C-27 s.95(4)); Bill C-36 does not create a Tribunal
Notable case

Bill C-36 proposes administrative penalties up to the higher of $10M or 3% of gross global revenue and offence fines up to the higher of $25M or 5%. Not law.

How Canuckt keeps you penalty-free:
Reform readiness assessment that scores you against Bill C-27 as tabled in 2022, clearly labelled as advisory
Parliamentary history of Bill C-27 and the current status of Bill C-36, shown as a proposal, never as law
Automated decision-making inventory and transparency notices you can use under PIPEDA and Law 25 today
Side by side gap analysis between PIPEDA and the federal reform proposals

Run a free CPPA / Bill C-27 gap assessment

Complete a short guided assessment, get a scored gap report, and see exactly what you need to do to comply with CPPA / Bill C-27 — in under 3 hours. Free forever.

Start free assessment
No credit card
Results in hours
Canadian data residency

Our own compliance

We run our own compliance programme inside Valdra — the product we sell. Our SOC 2, ISO 27001 and ISO 42001 programmes are actively in progress; we do not claim certifications we do not yet hold.

Valdra compliance badge — click to verify
  • PIPEDA
  • Law 25 (Quebec)
  • CASL
  • Data hosted in Canada 🇨🇦
  • AI governance
View our Trust Centre

Self-declared, not audited by a third party. Click the badge to verify it is genuine and see what it covers.