Bill C-36: An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts

Virtually every business in Canada that collects customer, employee, or user data in the course of commercial activities will be affected — from a small e-commerce retailer in Ontario processing online orders and email lists, to a mid-sized financial services firm in Alberta handling sensitive client records, to a national telecom or tech company running automated decision systems and cross-border data transfers. Day-to-day activities touched include obtaining customer consent before collecting personal information, maintaining a written privacy management program, reporting data breaches to regulators and affected individuals, responding to customer access and deletion requests within 30 days, and documenting the purposes for which data is collected and used. Size matters significantly: penalties can reach the greater of $10 million or 3% of gross global revenue for administrative violations, and up to $25 million or 5% of global revenue for criminal offences, meaning larger organizations face much steeper exposure, though the Commission is required to consider an organization's size, revenue, and capacity when making enforcement decisions.