Canada's third attempt to replace PIPEDA.

The proposal would cover commercial activity, federal-sector employee data, and interprovincial or international handling, subject to exemptions. Where PIPEDA already applied, the new statute is broader. You need a record-level jurisdiction and flow rule, not a single "we are covered" determination.

If a substantially similar provincial law governs an intra-provincial activity, it continues to apply there. The overlap question is per data flow, so map applicability at the flow level.

The definition of personal information expressly includes information inferred about an individual. Scores, segments, predictions, profiles, and model outputs you derive from other data are in scope, not just the inputs you collected.

This closes a gap many teams left in their Law 25 inventories: derived attributes were documented as analytics metadata rather than personal information. Under C-36 they attract the same duties, including access, correction, and disposal.

Under the proposal, a child is under 18, and children's information is listed as sensitive. Law 25's consent rule for children draws the line at 14. If your controls stop at 14, teens aged 14 to 17 are uncovered.

Sensitive information attracts heightened protection duties. Treat the under-18 population as a distinct control layer across collection, use, disclosure, and security, not as an extension of the under-14 consent workflow.

The proposed legitimate-interest exception lets an organization collect, use, or disclose personal information without consent, but only when a recorded interest outweighs the foreseeable adverse effects on the individual. The gate requires a documented interest, a privacy impact assessment, an adverse-effect analysis, and mitigation measures.

This is the consent exception most likely to be misused. Casual "we have a legitimate interest" reasoning will not survive scrutiny without the recorded analysis behind it.

Before personal information is disclosed or transferred outside Canada, the proposal would require a privacy impact assessment and mitigations. Law 25 teams already do transfer assessments, but for Quebec-origin transfers. The C-36 trigger is any Canada-origin outbound flow.

The duty attaches before the transfer happens. Your existing transfer assessment workflow needs a new gate: no outbound disclosure without a completed PIA and documented mitigations.

Systems that assist or replace human judgment can trigger explanation and human-review duties when they produce legal or similarly significant effects on individuals. This reaches beyond fully automated decisions: decision-support systems are in scope too.

Law 25 teams inventoried exclusively automated decisions. The C-36 lens is wider, so your inventory needs to capture assistive systems like scoring and recommendation engines.

Disposal requests can require deletion or anonymization and downstream service-provider action, with documented exceptions. Deleting a row in your own database is not enough when copies live with processors.

You need deletion propagation: a defined path from request intake to every downstream holder, plus refusal records for documented exceptions where disposal does not apply.

The proposed Privacy Commissioner can request program materials, investigate, audit, and order measures. The question is not whether you have policies, but whether you can produce the evidence behind them on demand.

"We already do PIAs" is not enough if the PIA gate misses legitimate-interest uses or transfers outside Canada. Each control needs its trigger, scope, decision rule, evidence, and owner mapped to the proposed federal requirement.