Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Canada: data, AI and cyber laws

Part of Americas.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Proposed
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date set
Enacted
Canada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date set
In force
PIPEDACanada's federal private-sector privacy law based on 10 fair information principles, with mandatory breach reporting to the OPC and notification of individuals for breaches creating a real risk of significant harm. It is proposed to be replaced by the Protecting Privacy and Consumer Data Act (Bill C-36, tabled June 2026).In effect since Jan 1, 2001

Past deadlines

MilestoneJun 15 · 4 months ago
Canada Bill C-8 / CCSPARoyal AssentBill C-8 receives Royal Assent (S.C. 2026, c. 9); Telecommunications Act amendments take effect.Canada
MilestoneJun 15 · 4 months ago
Canada Bill C-36 (PPCDA)Bill C-36 tabled (first reading)Government introduces the PPCDA in the House of Commons.Canada
MilestoneJun 18, 2025 · 16 months ago
Canada Bill C-8 / CCSPABill C-8 introducedFirst reading in the House of Commons.Canada
ComplianceNov 1, 2018 · 8 years ago
PIPEDAMandatory breach reportingBreach of security safeguards reporting, notification and record-keeping obligations take effect.Canada
Takes effectJan 1, 2004 · 22.8 years ago
PIPEDAPIPEDA applies to all commercial activityExtended to commercial activity in provinces without substantially similar legislation.Canada
Takes effectJan 1, 2001 · 25.8 years ago
PIPEDAPIPEDA Part 1 in force (phase 1)Applies to federally regulated organisations.Canada