Canada's Privacy Reform Sets Sail Again: 2026 Legislative Direction and the Underlying Logic of the Industry

Canada’s Privacy Reform: From C-27 to a Fresh Start in 2026

In 2025, with former Prime Minister Trudeau's resignation and a federal election, Canada’s privacy reform process was once again interrupted. But in 2026, this wave is returning in a new form. According to IAPP reports, observers expect that a comprehensive privacy bill could be introduced in Parliament as early as this spring or within the first quarter. This time, however, the political and policy environment is completely different.

Recap: Why C-27 Failed

Bill C-27 (the Digital Charter Implementation Act) has been the core reform vehicle advanced by the Canadian federal government since 2022, containing three pieces of legislation: the Consumer Privacy Protection Act (CPPA), the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). In early 2025, Trudeau resigned and triggered an early election, and C-27 died when Parliament was dissolved. In fact, C-27 had already been stalled before that: many parliamentarians and privacy stakeholders criticized AIDA for vague definitions of key AI terms such as “high-impact systems,” and for the entire bill package being too bulky.

Teresa Scassa, Research Chair in Information Law and Policy at the University of Ottawa, and Constantine Karbaliotis of nNovation Counsel, both pointed out that a new bill might not be introduced by the end of 2025 as expected, because “data sovereignty concerns” had come to dominate the government’s agenda. In the second batch of nation-building projects announced by Canadian Prime Minister Mark Carney in November 2025, a data sovereignty agenda was explicitly proposed, with a dedicated Major Projects Office established for it. This development has profoundly influenced the framework of privacy legislation.

The Potential Outline of the New Bill: Data Sovereignty and Risk Assessment

Multiple sources have revealed that a newly introduced bill is unlikely to bundle comprehensive AI regulation as C-27 did. Karbaliotis believes that a robust privacy law is itself a cornerstone of AI regulation and should not be dragged down by broader AI legislative plans. Scassa also expects that the new privacy bill will fill the gaps in the non-AI portions of C-27, such as strengthening privacy protection for children and youth, and redefining “legitimate interests” as an independent basis for processing data, rather than merely an exception to “consent.”Data sovereignty provisions will become a distinctive feature of the new bill. Karbaliotis predicts that the new bill will add risk assessment requirements for cross-border data transfers, which may partially absorb at the federal level the transfer provisions of Quebec's Law 25. He noted that the privacy portion of C-27 failed to explicitly require privacy impact assessments, and that Europe has long had doubts about Canada's regulatory capacity to "forward data to third countries." When the EU updated its adequacy decision for Canada in January 2024, it directly pointed to C-27 as an important factor and said it would "closely monitor" subsequent legislation—Karbaliotis at the time called the EU's decision a "fundamental error" because it weakened legislators' urgency to modernize PIPEDA.

The Privacy Commissioner's Demands: Stronger Enforcement Powers and Child Protection

In a letter to the Senate committee, Canada's Privacy Commissioner Philippe Dufresne stressed that Canada needs "modern privacy laws that reflect the modern world." He put forward seven key recommendations, including: issuing binding orders, imposing administrative fines, conducting proactive audits, promoting a de-identification framework, granting citizens the right to erasure, and specifically calling for a code of conduct for children's privacy. He pointed out that PIPEDA currently has no special protections for children, and that children are highly vulnerable in the digital world.

If these demands are incorporated into the new bill, they will significantly enhance the enforcement capacity of the Office of the Privacy Commissioner of Canada (OPC), shifting it from "advisor" to "regulator." This would be a substantive leap for Canada's privacy oversight system.

Industry Impact: Compliance Costs and Innovation Balance

For Canada's technology industry and digital economy, the direction of privacy reform will directly affect business models. Data sovereignty requirements and cross-border transfer risk assessments may impose higher compliance costs on Canadian companies that rely on U.S. cloud services. At the same time, however, clear and strict privacy rules can also enhance consumer trust and help Canada secure a favorable position in digital trade negotiations.

Of particular note, Canada's national AI strategy is expected to be released this year. The public consultation conducted in October 2025 attracted 11,300 participants and generated 64,600 responses, covering eight major areas including AI adoption in industry and government, AI commercialization, and safe AI development. Scassa believes that the AI strategy will focus mainly on investment and economic applications, while consumer harm caused by AI-driven automated decision-making may be addressed through privacy legislation. This is in effect a "sectoral AI governance" approach—although AIDA failed to pass, AI governance has not stopped.

Global Perspective: Data Sovereignty as a Key VariableCanada's privacy reform is not an isolated event. Globally, data sovereignty has become a core issue in technology competition. The EU exerts external influence through the GDPR and adequacy decisions; U.S. states have enacted privacy laws one after another; and countries such as China and India have also built their own rules for cross-border data transfers. Canada's push for data sovereignty legislation at this time is an attempt to seek strategic autonomy amid great-power competition.

The Carney government's "Major Projects Office" links data sovereignty with nation-building projects, meaning that Canada hopes to combine data governance with infrastructure investment and economic security. This approach may reshape the international cooperation landscape of Canada's technology industry.

The Next Three to Ten Years: Long-Term Trends Worth Watching

From specific legislation to strategic direction, several trends are worth continued attention:

1. Privacy enforcement truly "grows teeth": If the OPC gains the power to impose administrative fines and conduct proactive audits, Canada will bid farewell to the era of "soft regulation." This affects not only domestic companies but also every multinational tech company operating in Canada.

2. A "Canadian model" for cross-border data rules: Canada is likely to take a middle path between the EU's GDPR and U.S. sectoral laws, emphasizing data sovereignty while maintaining cross-border data flow. Once this model matures, it could become a reference template for other small and medium-sized economies.

3. The convergence of AI governance and privacy: Even if AIDA is not revived, privacy law will assume the foundational function of AI governance. As the AI strategy is implemented, Canada may gradually build its AI governance puzzle through sectoral rules (such as finance, healthcare, and recruitment) rather than one sweeping omnibus law.

4. Children's privacy and age assurance become a new focus: The Senate's S-209 bill (age assurance) and the OPC's advocacy for children's privacy indicate that Canada is making the protection of minors a core issue in digital policy, and may in the future give rise to "privacy by design" standards for young people.

Conclusion: Why Does This Have Strategic Significance?

For Canada's technology industry, privacy reform is not merely a legal upgrade; it is the institutional foundation of national digital sovereignty. Against the backdrop of an accelerating restructuring of the global data governance landscape, whether Canada can enact a law that both protects citizens' rights and promotes innovation will determine its international niche in AI, cloud services, and the data economy over the next decade. The linkage between the Carney government's data sovereignty agenda and privacy legislation is precisely the embodiment of this strategic intent. Therefore, this legislative contest in 2026 deserves the continued attention of everyone who follows Canada's technological future.