Governance, risk & compliance

Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force Bill C-36 first reading (15 June 2026)

PROPOSED LAW, NOT IN FORCE.

FOR PLANNING ONLY. The Protecting Privacy and Consumer Data Act (PPCDA) is Part 1 of Bill C-36, introduced in the House of Commons on 15 June 2026 and at second reading as of 5 October 2026.

If passed, it would replace Part 1 of PIPEDA (PIPEDA would be renamed the Electronic Documents Act). It comes into force only on a date set by order in council, and not before the new Digital Safety and Data Protection Commission exists, which in turn depends on Bill C-34, the Safe Social Media Act.

PIPEDA remains the federal private-sector privacy law until then. It keeps the structure of the Consumer Privacy Protection Act from Bill C-27 (which died in January 2025) and changes it in ways that matter for planning: a privacy impact assessment and risk mitigation before personal information is disclosed or transferred outside Canada (s.

57); a privacy impact assessment before relying on legitimate interest, which now also covers disclosure (s. 18(3)-(5)); a defined child (under 18) whose information is sensitive and whose rights a parent or guardian exercises unless the child can and wants to (ss.

2 and 4); automated decision explanations for decisions with a legal or similarly significant effect, plus the right to make written representations to an employee who can review the decision (s. 63(4)-(6)); and a new regulator, the Privacy and Consumer Data Commissioner within the Digital Safety and Data Protection Commission, with no separate Tribunal.

Administrative monetary penalties reach the higher of $10 million and 3% of gross global revenue (s. 114) and fines the higher of $25 million and 5% (s.

145). A penalty cannot be imposed where the organization shows due diligence or was following an approved certification program (s.

113(3)). Section numbers follow the first-reading text and may change in committee.

Every PIPEDA control and every CPPA control is mapped here, so work already done for PIPEDA counts toward this framework, and the assessment shows only the gaps to plan for.

How Lavawall® helps you prepare for Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force

This is proposed legislation, not law in force. Lavawall® maps it to the same shared controls as the privacy law that applies today, so a control you already run and evidence counts toward both, and the readiness assessment shows only what you would need to add. Those controls run across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, and your posture is tracked continuously instead of once a year.

• Assess your current state against Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Protecting Privacy and Consumer Data Act (PPCDA) - Draft, Bill C-36, not in force as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.