Bill C-36 and trust centers

Bill C-36 is not law yet. It is worth preparing for because its likely demands, documented assessments of transfers outside Canada, are the same things buyers already ask.

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Bill C-36, which would enact the Protecting Privacy and Consumer Data Act (PPCDA), was introduced in the House of Commons on 15 June 2026 and is at second reading. If passed, it would replace Part 1 of PIPEDA as Canada's federal private-sector privacy law. It is the third attempt at this reform, after Bill C-11 in 2020 and Bill C-27 in 2022. Nothing in it applies yet, and its final form may change in committee.

What could Bill C-36 change for a trust centre?

As introduced, the bill includes an explicit requirement that an organization disclose or transfer personal information outside Canada only after assessing and mitigating the privacy risks of the transfer. It also recognises the fundamental right of privacy of individuals, gives particular attention to children's personal information, and would bring order-making powers and penalties. For a supplier, the practical effect is that Canadian customers would need documented facts about where you process their data and how it is protected, which is what a trust centre's residency and subprocessor sections already provide.

What should we do now?

1. Publish data locations precisely. Region by region, including backups and support access.
2. Keep the subprocessor list complete and dated, with locations and a change-notice option.
3. Prepare a transfer summary your customers can attach to their own assessment: what leaves Canada, why, and under what safeguards.
4. Watch the bill. Committee changes may alter the details. Check its status on Parliament's LEGISinfo before relying on any provision.

Common questions