PIPEDA to CPPA (Bill C-27) Readiness Matrix

📚 New here? Start with PIPEDA Compliance: The Complete Guide for the plain-language overview, then use this matrix to audit your controls.

Is PIPEDA still in force in 2026?

Yes. As of 2026, PIPEDA, the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5), remains Canada’s federal private-sector privacy law. The proposed replacement, the Consumer Privacy Protection Act (CPPA) contained in Bill C-27 (Digital Charter Implementation Act, 2022), died with the bill on the Order Paper in January 2025. Until a successor bill passes, PIPEDA continues to govern the collection, use, and disclosure of personal information in the course of commercial activity in federally regulated industries and in provinces without substantially-similar legislation.

The provinces with substantially-similar private-sector laws (and therefore PIPEDA exempt for non-federally-regulated business) are Quebec (Law 25), Alberta (PIPA), and British Columbia (BC PIPA). All other provinces fall under PIPEDA for commercial activity.

The 10 PIPEDA Fair Information Principles

PIPEDA’s substantive obligations are codified in Schedule 1 as the Fair Information Principles, drawn from the CSA Model Code:

1. Accountability
2. Identifying Purposes
3. Consent
4. Limiting Collection
5. Limiting Use, Disclosure, and Retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual Access
10. Challenging Compliance

The PIPEDA-to-CPPA Transition Matrix

This matrix shows, for each PIPEDA principle: the corresponding CPPA proposal in Bill C-27, what materially changes for Canadian SMBs, and the readiness action you can take today.

What materially changes for SMBs if the CPPA becomes law

The CPPA’s most significant practical changes for Canadian small and mid-sized businesses are:

1. Mandatory privacy management program with documented policies, employee training, and a designated privacy officer. PIPEDA implies this; the CPPA requires it (s.9).
2. New right to disposal, individuals can request that their personal information be disposed of (s.55). PIPEDA has no equivalent.
3. Data portability, under defined data-mobility frameworks, individuals can ask that their information be transferred to another organization (s.72). New under CPPA.
4. Algorithmic transparency, when an automated decision system is used to make a “prediction, recommendation, or decision about an individual” with significant impact, on request the individual must receive an explanation (s.63(3)).
5. Significantly higher penalties, Administrative Monetary Penalties of up to 3% of gross global revenue or $10M (s.94), plus potential fines of up to 5% of revenue or $25M for offences (s.128).
6. New Personal Information and Data Protection Tribunal, a specialized tribunal to review Privacy Commissioner orders (s.95+). PIPEDA has no equivalent.
7. Codified breach-reporting, already exists under PIPEDA s.10.1 since 2018; CPPA largely carries forward.

Bill C-27 status (as of 2026)

Bill C-27 (the Digital Charter Implementation Act, 2022) was introduced in June 2022. It bundles three Acts: the CPPA, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act (AIDA). The bill reached Second Reading and Committee stages across multiple sessions, then died on the Order Paper when Parliament was prorogued in January 2025. No successor bill has been introduced as of this review.

Practical implication: PIPEDA remains the federal private-sector privacy law in Canada. Any SMB making compliance decisions in 2026 should align to PIPEDA today and plan for CPPA-equivalent capabilities (privacy management program, retention/disposal, portability, algorithmic transparency) within a 12–18 month implementation horizon once a successor bill advances.

The SMB readiness checklist

You can take the following steps under PIPEDA today; they will substantially position you for the CPPA if and when a successor bill revives it:

1. Designate a privacy officer in writing. Update your employee handbook.
2. Inventory the personal information your business collects. For each field, document the purpose.
3. Rewrite your public privacy policy in plain language. Post it on your website.
4. Build a written retention and disposal schedule. Map it to your IT systems.
5. Add a workflow for: access requests, correction requests, deletion requests, and complaints.
6. Adopt a security baseline. We recommend CIS Controls v8.1 Implementation Group 1 (IG1) as the floor for SMBs.
7. Document any automated decisioning. If your CRM, hiring tool, or pricing engine makes recommendations about individuals, write down the inputs and the logic.
8. Test your breach-reporting workflow. Run a tabletop exercise once per year.
9. Train every employee annually on privacy basics. Track completion.
10. Review vendor contracts. Confirm each is bound to PIPEDA-equivalent or stronger obligations.

About this matrix

This matrix is maintained by Mike Pearlstein, CISSP, Founder and CEO of Fusion Computing Limited. Mike has guided Canadian SMBs through privacy-program design under PIPEDA since 2012. Fusion Computing is a Microsoft Solutions Partner (Security, Modern Work, Infrastructure) and a CompTIA Managed Services Trustmark holder. We update this matrix whenever the federal privacy-bill status changes materially; the date below reflects the most recent review.

If you’d like a PDF version or want help mapping your business to this matrix, book a 30-minute consult.

Common Questions

Is PIPEDA still in force in 2026?

Yes. PIPEDA is the federal private-sector privacy law in Canada and remains in force in 2026. The proposed replacement under Bill C-27 (the Consumer Privacy Protection Act, or CPPA) died with the bill on the Order Paper in January 2025. PIPEDA continues to govern personal-information handling in federally regulated industries and in provinces without substantially-similar provincial laws.

When will the CPPA replace PIPEDA?

There is no confirmed date. Bill C-27 was introduced in June 2022 but died on the Order Paper when Parliament was prorogued in January 2025, so a successor bill would need to reintroduce the CPPA. Even after passing, the Act would have a transition period, typically 12 to 24 months, before all provisions are in force. SMBs should continue PIPEDA compliance and prepare for CPPA-equivalent capabilities over a 12-to-18-month horizon.

Does my SMB need to comply with both PIPEDA and provincial privacy laws?

It depends where you operate. If your business is federally regulated (banks, telecoms, airlines) PIPEDA always applies. Otherwise: Quebec businesses are governed by Law 25, Alberta by PIPA, BC by BC PIPA, all substantially similar to PIPEDA. In other provinces PIPEDA applies for commercial activity. Multi-province businesses generally align to the strictest applicable law as a baseline.

What is the biggest practical change CPPA introduces for SMBs?

Two changes have the biggest operational impact. First, a written privacy management program (CPPA s.9) becomes mandatory rather than implied. Second, Administrative Monetary Penalties of up to 3% of gross global revenue or $10M (whichever is higher) significantly raise the stakes, PIPEDA’s enforcement mechanism is much weaker by comparison.

What is data portability under CPPA?

Under CPPA s.72, individuals would have the right to direct that their personal information be transferred to another organization, where the transfer is provided for by a federal data-mobility framework. Frameworks would be sector-specific (e.g. banking under open banking). This is new, PIPEDA does not have an equivalent.

What is algorithmic transparency under CPPA?

CPPA s.63(3) would require that, on request, an organization explain how an automated decision system was used to make a prediction, recommendation, or decision about an individual that could have a significant impact on them. This is a new obligation. SMBs using CRMs, hiring tools, pricing engines, or credit-scoring systems should start documenting how those systems make decisions about individuals now.

Part of the Canadian IT Compliance Hub – PIPEDA, PHIPA, OSFI B-13, Bill C-8, CyberSecure Canada and cyber-insurance guidance for Canadian SMBs, in one place.

Updated August 5, 2026