Can an acquiror’s ability to review customer lists and other private information possessed by a target now be in jeopardy? The new proposed Bill C-36 suggests the answer is yes, and the implications are well beyond even the M&A deal table.
On June 15, 2026, the Government of Canada introduced Bill C-36 to enact the Protecting Privacy and Consumer Data Act (“PPCDA”)[1], which would significantly reform Canada’s private-sector privacy regime.[2] For organizations, the new framework could affect how personal information is not only managed and protected in day-to-day operations, but also in stealthy and confidential strategic transactions as noted above.
Bill C-36 comes against a backdrop of growing privacy concerns arising out of the development and adoption of digital and data-driven technologies.[3] At its core, the PPCDA seeks to strengthen protections for personal information while supporting responsible data use, innovation and a proportionate approach to compliance.[4] Those objectives are backed by greater expectations around privacy governance and a significantly stronger oversight and enforcement framework.[5]
For buyers, sellers and boards, the result is a broader set of privacy considerations that may need to be addressed both before and at the deal table.
What Privacy Changes are Proposed Under Bill C-36?
Four features stand out.
- New watchdog, stronger enforcement. Bill C-36 would establish the Digital Safety and Data Protection Commission of Canada to administer the PPCDA, with the ability to issue binding orders to ensure organizations comply with the law.[6] The maximum administrative monetary penalty would be the greater of $10 million or 3% of an organization’s gross global revenue.[7] Certain knowing contraventions would also constitute offences, with fines on indictment of up to the greater of $25 million or 5% of gross global revenue.[8] The Bill would also create a statutory private right of action in specified circumstances.[9]
- Greater emphasis on privacy governance. Organizations would be required to implement and maintain a privacy management program and designate one or more individuals responsible for compliance.[10] Privacy impact assessments would also be required in specified circumstances, including before relying on the proposed “legitimate interest” exception to consent and before disclosing or transferring personal information outside Canada.[11]
- Expanded individual rights. The PPCDA would provide individuals with a right to request disposal of their personal information, subject to specified exceptions, and establish a data-mobility framework for prescribed organizations.[12] Individuals could also request an explanation where an automated decision system makes a prediction, recommendation or decision that could have a legal or similarly significant effect on them.[13]
- New rules for automated decision-making. Organizations using automated decision systems that could have a significant effect on individuals would have to make available a general account of that use.[14] The Bill also distinguishes between “de-identified” and “anonymized” information. De-identified information would remain personal information under the PPCDA, while anonymized information would fall outside the Act.[15]
How Could Bill C-36 Affect M&A Transactions
Two aspects of the proposed regime are particularly relevant to M&A.
First, the business transaction exception narrows. PIPEDA currently permits parties to use and disclose personal information without consent for the purposes of a prospective transaction.[16] Under the PPCDA, pre-closing use or disclosure would generally be permitted only where the information has first been de-identified, unless de-identification would undermine the objectives of the transaction and the organization has considered the risk of harm to the individuals concerned.[17] Data rooms, customer lists and employee files will need to be prepared with that test in mind.
Second, the proposed enforcement and governance requirements may increase the importance of privacy in transaction diligence. Buyers may want to review a target’s privacy program, impact assessments, breach history and data practices, while identified risks may affect representations and warranties, indemnities or other transaction terms. Sellers may similarly benefit from addressing privacy issues before the diligence process begins.
How Can Businesses Prepare for Bill C-36?
- Put privacy on the board’s risk register. Directors and management should understand what personal information the business holds, where it flows, particularly across borders, and who is responsible for privacy compliance.
- Assess gaps against the Bill as tabled. Businesses can compare their existing privacy programs, consent practices, retention procedures and service-provider arrangements against the proposed requirements. Although the PPCDA addresses service providers specifically, it does not impose all organizational obligations on them in respect of information transferred to them by another organization.[18]
- Build the processes the new rights require. Disposal requests, data mobility and explanations of automated decisions require operational processes, not simply changes to privacy policies.
- Structure deal disclosures with privacy in mind. Where a transaction is underway, parties should consider whether personal information is necessary for the transaction and whether it can be de-identified before disclosure. Where identifiable information is necessary, the reasons and associated risks should be considered and documented.
While Bill C-36 remains proposed legislation and may change as it proceeds through Parliament, the Bill as currently drafted, signals stronger privacy enforcement, governance requirements and new rules for handling personal information in business transactions. Businesses should consider how their current privacy practices align with the proposed framework.
If you have questions about Bill C-36 or its implications for your business or transaction, a member of our Business Law Group would be pleased to assist.
The author would like to thank Alia Samem, Student-at-Law, for her assistance with this article.
[1] Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 1st Sess., 45th Parl., 2026 [“Bill C-36”].
[2] Innovation, Science and Economic Development Canada, “Backgrounder: Government of Canada introduces legislation to Protect Canadians’ Privacy in the Digital Age” (15 June 2026), online: <https://www.canada.ca/en/innovation-science-economic-development/news/2026/06/government-of-canada-introduces-legislation-to-protect-canadians-privacy-in-the-digital-age.html>.
[3] Ibid.
[4] Ibid.
[5] Ibid.
[6] Ibid.
[7]Supra note 1 at s. 113-114.
[8] Ibid at s. 145.
[9] Ibid at s. 132.
[10] Ibid at s. 8-10.
[11] Ibid at s. 18 (3)-(5) & s. 57.
[12] Ibid at s. 54 & s.72.
[13] Ibid at s. 63 (4)-(6).
[14] Ibid at s. 62(2)(c).
[15] Ibid at s. 2 & s. 6(5).
[16] Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) at s. 7.2(1) [“PIPEDA”].
[17] Ibid at s. 22(1)-(2).
[18] Ibid at s. 11(1)-(2).