CPPA vs PIPEDA: What Bill C-27 Proposed, and Why PIPEDA Still Applies

The Consumer Privacy Protection Act (CPPA) — the core component of Bill C-27 — was designed to replace PIPEDA's private-sector privacy rules. Bill C-27 never became law, and PIPEDA remains in force.

Last updated: September 2026

What Is the CPPA?

Bill C-27, the Digital Charter Implementation Act, 2022, was a government bill in the 44th Parliament. According to the summary in the bill text, it had three parts:

• Part 1 would have enacted the Consumer Privacy Protection Act (CPPA) to govern the protection of personal information in the course of commercial activities. It would have repealed Part 1 of PIPEDA and changed that Act's short title to the Electronic Documents Act.
• Part 2 would have enacted the Personal Information and Data Protection Tribunal Act, establishing an administrative tribunal to hear appeals of certain Privacy Commissioner decisions under the CPPA and to impose penalties for contraventions of certain CPPA provisions.
• Part 3 would have enacted the Artificial Intelligence and Data Act (AIDA) to regulate international and interprovincial trade and commerce in artificial intelligence systems, by requiring certain persons to adopt measures to mitigate risks of harm and biased output related to high-impact AI systems.

In short, the CPPA would not have amended PIPEDA's privacy rules in place: it would have repealed Part 1 of PIPEDA and replaced it with a new statute, with a new tribunal able to impose penalties for contraventions of certain CPPA provisions.

Legislative History

From LEGISinfo, Bill C-27 (44-1):

• June 16, 2022: First reading in the House of Commons
• April 24, 2023: Second reading and referral to committee
• Consideration in committee: Not completed
• January 6, 2025: The session ended. Parliament was prorogued, Bill C-27 died on the Order Paper, and it never became law.

What Comes Next: Bill C-36

Federal privacy reform was re-introduced as Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts. It was introduced and read a first time in the House of Commons on June 15, 2026, and is at second reading. Its content could change before passage, and it is not yet law. Track it on LEGISinfo, Bill C-36 (45-1).

What Applies Today

PIPEDA remains in force. Under PIPEDA, knowingly contravening certain provisions — including the breach reporting requirement in section 10.1 — or obstructing the Commissioner is an offence (s. 28), punishable on indictment by a fine of up to $100,000. Separately, after receiving the Commissioner's report, a complainant may apply to the Federal Court for a hearing (s. 14), and the Court may award damages, including damages for humiliation (s. 16); the Act sets no cap on those damages. Source: PIPEDA on the Justice Laws website.

What to Do Now

PIPEDA remains in force, and there are no CPPA requirements to prepare for. Practical steps that do not depend on any bill:

1. Document consent processes — review whether your consents are clear and specific
2. Review deletion capabilities — understand how you would delete or de-identify personal information when appropriate
3. Assess AI and automated decision systems — document how you use AI in decisions affecting individuals
4. Follow Bill C-36 — check its actual text as it progresses, since its content could change before passage

Common Misconceptions

1. "The CPPA is Canada's new privacy law" Reality: Bill C-27 died on the Order Paper in January 2025. The CPPA was never enacted.

2. "PIPEDA has been replaced" Reality: PIPEDA remains in force today.

3. "Bill C-36 is already law" Reality: Bill C-36 was introduced on June 15, 2026, and is at second reading. It is not yet law, and its content could change before passage.

Frequently Asked Questions

Q: When will the CPPA come into force? A: It won't. Bill C-27 died on the Order Paper when Parliament was prorogued in January 2025, and the CPPA was never enacted. Federal reform was re-introduced as Bill C-36 on June 15, 2026 and is at second reading; it is not yet law.

Q: Do I need to change my practices now? A: PIPEDA still applies and must be complied with. There are no CPPA standards to align with, because the CPPA was never enacted.

Q: How does the CPPA compare to Quebec Law 25? A: Law 25 is in force; the CPPA never was. Federally, PIPEDA — not the CPPA — is the law that applies.

Q: Does the CPPA apply to small businesses? A: The CPPA does not apply to anyone — it was never enacted. PIPEDA's obligations apply today.

---

Stay Current on Canada's Privacy Law Reform

Until the CPPA or a successor bill becomes law, PIPEDA is the law to comply with. Canada Compliance AI helps Canadian SMEs work through CASL, PIPEDA and Quebec Law 25: a free two-minute compliance check, readiness scores, a prioritized task plan, a 24-month breach register and an exportable audit log. See what's live and what's planned.

Start your free trial today — and be ready for whatever comes next.

Related reading: Bill C-27 and AIDA: What Canada Proposed for AI Regulation | What is PIPEDA? | Bill C-36 on LEGISinfo