Bill C-27 Canada
Definition
Bill C-27 Canada
Bill C-27 Canada was the federal bill that would have replaced PIPEDA with the Consumer Privacy Protection Act and introduced an artificial intelligence statute. It died on the Order Paper, so PIPEDA still governs commercial handling of personal information.
The bill was introduced in June 2022 and carried three separate acts inside one legislative package.
It reached committee and stopped there — Parliament was prorogued in January 2025, and every bill that had not passed died with the session.
Buyers still encounter the name constantly in vendor documentation — which is a problem, because compliance programmes built around an unpassed bill are built around nothing.
Key takeaways
- Bill C-27 would have enacted three statutes, including a replacement for PIPEDA.
- It died when Parliament was prorogued in January 2025 without ever passing.
- PIPEDA remains the operative federal private sector privacy law in Canada.
- Later reform bills have been introduced, so the file is dormant rather than closed.
How it works
The bill bundled three acts together. The Consumer Privacy Protection Act would have replaced the private sector part of PIPEDA, a tribunal act would have created a new appeal body, and an artificial intelligence act would have been Canada’s first.
Parliamentary records show where it stopped. The bill’s status remained at consideration in committee in the House of Commons after second reading and referral on 24 April 2023.
Nothing after that changed the law — prorogation cleared the Order Paper, and a bill that has died must be reintroduced from the beginning rather than resumed.
| What people assume | What is actually true |
|---|---|
| CPPA is Canadian law | It never passed; PIPEDA still applies |
| Canada has an AI statute | The proposed act died with the bill |
| A privacy tribunal exists | It was proposed, never created |
| Fines reached new maximums | The higher penalties were proposed only |
| Reform is abandoned | Later bills have been introduced federally |
So the operative law is the older one. PIPEDA governs how private sector organisations collect, use, and disclose personal information in the course of for-profit, commercial activities across Canada.
For outsourcing that means accountability, the first of PIPEDA’s ten principles, remains the governing idea rather than any prescribed contract schedule.
Organisations stay responsible for personal information they transfer to a third party for processing, and the mechanism for discharging that duty is contractual.
Examples
The practical issue is vendor documentation that cites a law which never existed. The situations below are common, and each one has embarrassed a well run firm.
A Toronto bank receives a provider questionnaire claiming CPPA alignment. The claim is unverifiable because the statute was never enacted, and the bank’s diligence has to fall back on PIPEDA.
An Ontario health technology firm builds consent flows to draft CPPA standards. The work is not wasted, but it is voluntary, and calling it a legal requirement misleads the board.
A Vancouver company offshores support to Manila under a contract citing the artificial intelligence act. That reference has no legal content, and the contract’s real protections sit in its PIPEDA clauses.
A Montreal retailer conflates federal reform with Quebec’s own privacy law. Quebec legislated separately and its rules are in force, which is a distinction the bill’s failure makes sharper.
Related terms
Canadian privacy vocabulary now contains several terms that describe proposals rather than law. The definitions here separate ideas that tender documents and sales decks routinely run together.
- PIPEDA outsourcing: the law that actually governs Canadian commercial personal data.
- GDPR outsourcing: the European regime the proposed act borrowed from.
- CCPA outsourcing: the Californian consumer regime often compared with it.
- ISO 27701: the privacy certification buyers use when statutes are unsettled.
- Nearshore outsourcing: the delivery model Canadian buyers most often use.
- Back office outsourcing: the work type that generates most transfers here.
- Compliance outsourcing: contracting the compliance function rather than the data handling.
FAQ
Is Bill C-27 law in Canada?
No. It died on the Order Paper when Parliament was prorogued in January 2025 and never received Royal Assent.
What governs Canadian privacy now?
PIPEDA, alongside provincial laws in Quebec, Alberta and British Columbia, and sector rules for health and financial information.
Should we still prepare for the CPPA?
Preparing for stronger accountability is sensible. Describing that preparation as statutory compliance is not, because the statute does not exist.
Did the artificial intelligence act survive separately?
No. It was part of the same bill and died with it, leaving Canada without a dedicated federal AI statute.
Can a bill be revived after prorogation?
Only by reintroduction. The parliamentary process starts again, which is why later reform has come through new bills.
Does this change our offshore contracts?
It means they should cite PIPEDA rather than a proposal. The substantive protections you want are available today under the accountability principle.
Search Outsource Accelerator and start where the provider can show you the governing terms.
Independent
