Canada's New Privacy Law (Bill C-36) and Your AI

Canada is rewriting the rulebook on privacy for the first time in a generation, and AI is squarely in its sights. Bill C-36, the Protecting Privacy and Consumer Data Act, would retire the 25-year-old PIPEDA and replace it with rules built for a world where software makes decisions about people. It is not law yet, and there is no need to panic. But if your business uses AI, or plans to, the direction of travel is clear enough that a few smart moves now will save you a painful retrofit later.

What Bill C-36 actually changes

Strip away the legal language and the bill's core ideas are straightforward, and reasonable. Privacy becomes a recognized fundamental right rather than a checkbox. Businesses must get meaningful, plain-language consent instead of burying terms in a wall of text. People gain a right to have their data deleted. And, most relevant to AI, organizations must be transparent when automated systems make significant decisions about individuals. Cross-border data transfers, common when you run AI on servers outside Canada, would need documented risk assessments. It is essentially a nudge from "collect everything, explain nothing" toward "collect what you need, explain what you do."

Where AI sits in the crosshairs

The provision that matters most for AI users is transparency around automated decision-making. If you let AI meaningfully influence decisions about people, who gets hired, approved, priced, or prioritized, you would need to disclose that and be able to explain it. That is a direct challenge to "black-box" AI, and a good reason to prefer systems you can account for.

This builds on the compliance thinking we laid out in Canada's AI regulations in 2026, C-36 is the privacy backbone that AI governance now hangs on.

It's not law yet, but that's the point

Here is the nuance worth holding onto: C-36 has not passed, and its obligations are not in force. You are not out of compliance with it today. But two things are already true. First, the laws that do bind you right now, PIPEDA, Quebec's Law 25, provincial privacy laws, CASL, already apply to AI in full, and regulators are already enforcing them. Second, the direction C-36 points is unambiguous and mirrors global norms. So the winning move is not to wait, it is to align now, cheaply, while your AI footprint is small and easy to shape.

Where this leaves you

Treat Bill C-36 not as a threat but as a preview of the rules of the road, and build for them now. Know where AI touches personal data in your business, be transparent when it affects people, get real consent, keep only the data you need, and prefer AI systems you can explain. Do that and you get two wins at once: you are protected under the laws that already apply today, and you are future-proofed for the ones clearly coming. In a market where trust is a competitive advantage, being able to say "we use AI responsibly, and here's how" is worth more than the compliance headache it avoids.

Frequently Asked Questions