--- title: Canada's Privacy Law Is Being Rewritten — What BC Small Businesses Should Do Before Bill C-36 Passes description: Bill C-36 would replace PIPEDA with proposed fines up to $25M or 5% of global revenue. Five practical steps for BC small businesses that use AI with customer data. image: https://go.daova.ai/hubfs/397007208412-privacy-supreme-court.png --- [Skip to content](https://go.daova.ai/blog/canadas-privacy-law-is-being-rewritten-what-bc-small-businesses-should-do#main-content) [![DAOVALOGO-0929-60pct-blog](https://go.daova.ai/hs-fs/hubfs/DAOVALOGO-0929-60pct-blog.png?width=1303&height=434&name=DAOVALOGO-0929-60pct-blog.png)Homepage](https://daova.ai) - [Services](https://daova.ai/#what) - [Framework](https://daova.ai/#path) - [Blog](https://go.daova.ai/blog) - [About](https://daova.ai/#trust) [Book a Session](https://daova.ai/contact) - [Services](https://daova.ai/#what) - [Framework](https://daova.ai/#path) - [Blog](https://go.daova.ai/blog) - [About](https://daova.ai/#trust) [Book a Session](https://daova.ai/contact) ![Paper-cut illustration of colleagues removing personal details from a document, with the Supreme Court of Canada in Ottawa behind them.](https://go.daova.ai/hs-fs/hubfs/397007208412-privacy-supreme-court.png?width=1774&height=887&name=397007208412-privacy-supreme-court.png) AI Strategy & Getting Started Privacy & Governance # Canada's Privacy Law Is Being Rewritten — What BC Small Businesses Should Do Before Bill C-36 Passes ![Victor Sh](https://go.daova.ai/hs-fs/hubfs/head%20photo.png?width=48&height=48&name=head%20photo.png) Victor Sh October 27, 2026 In June 2026, the federal government tabled **Bill C-36, the Protecting Privacy and Consumer Data Act (PPCDA)**, which would repeal the private-sector privacy provisions of PIPEDA and replace them with a new law ([Department of Justice](https://www.justice.gc.ca/eng/csj-sjc/pl/charter-charte/c36_1.html)). It is not law yet — it is still working its way through Parliament and may be amended. But the direction is clear, and the penalties proposed are not small: up to **C$10 million or 3% of global revenue** for non-compliance, and up to **C$25 million or 5% of global revenue** for the most serious offences ([IAPP](https://iapp.org/news/a/canada-s-bill-c-36-introduces-privacy-reforms-enforcement-changes)). For a small business, that is the moment to ask an uncomfortable question: if a customer asked you today where their data goes when you use AI, could you answer? ## What Bill C-36 Would Change - **Stronger consent.** Meaningful consent requirements get tighter, and customers gain clearer deletion rights. - **Automated decision-making.** Businesses would have to be more transparent about using automated systems — including AI — to make decisions about people. - **A new regulator.** Private-sector enforcement would move to a new Digital Safety and Data Protection Commission of Canada, with binding orders and fines. - **Sensitive data.** Children's data would be treated as sensitive, with additional obligations. None of these are exotic. They are the questions a well-run business should already be able to answer. ## Why This Hits Small Businesses Using AI Most SMBs now put customer information into AI tools every day: names and emails into a writing assistant, chat transcripts into a summarizer, invoices into a bookkeeping tool. Each of those is personal information leaving your control, sometimes to a provider whose data practices you have never read. You do not need a legal department to get ahead of this. You need to know what you have, where it goes, and who decides. ## Five Things to Do Before the Bill Passes 1. **Inventory your personal data.** One page: what customer and employee data you hold, where it lives, and who can see it. 2. **List every AI tool that touches it.** Include the ones individuals signed up for without telling you. That list is your exposure. 3. **Write a one-page AI data rule.** What may never be entered (ID numbers, health details, payment data), and what must be anonymized first. 4. **Fix your consent and privacy notice.** If your website or intake form does not mention AI processing, that is a gap to close. 5. **Train the team once.** Most exposure comes from a well-meaning employee pasting the wrong thing into the wrong tool. ### Quick Test: Could You Answer These? - Can you name every AI tool your business uses that sees customer data? - Do you know whether those tools train on your data, and how to turn it off? - Does your privacy notice mention AI at all? Two "no" answers is your prep list. ## Compliance Is Cheaper Than Cleanup The work above takes a few hours and costs nothing. A breach, a complaint, or a regulator's order does not. And unlike a lot of compliance exercises, this one has a business benefit: customers increasingly ask how their data is handled, and a clear answer wins work. This is the work DAOVA does with BC small and mid-sized businesses — practical [AI governance](https://go.daova.ai/blog), secure deployment, and team training. Eligible AI training for BC employers can be reimbursed up to 80% through the [B.C. Employer Training Grant](https://www.workbc.ca/employers-industry/funding-programs/bc-employer-training-grant) (up to $10,000 per participant). ## The Bottom Line Bill C-36 is not law, and it may change before it is. That is exactly why the preparation is worth doing now — you are building the habits you will need either way, at a moment when nobody is auditing you yet. **Your action this week:** write down the three AI tools your business uses most, and next to each one note what customer data it sees. If you cannot fill in the second column, that is the gap to close first. ## Share this post [mailto:https%3A%2F%2Fgo.daova.ai%2Fblog%2Fcanadas-privacy-law-is-being-rewritten-what-bc-small-businesses-should-do](mailto:https%3A%2F%2Fgo.daova.ai%2Fblog%2Fcanadas-privacy-law-is-being-rewritten-what-bc-small-businesses-should-do) ## Keep reading ### [![A team collaborating around a table with laptops](https://go.daova.ai/hs-fs/hubfs/blog-images/raii-funding-1029.jpeg?width=960&height=640&name=raii-funding-1029.jpeg) AI Strategy & Getting Started AI Investment Canada Just Added $500M for Businesses to Adopt AI — How BC Companies Can Line It Up With the ETG](https://go.daova.ai/blog/canada-just-added-500m-for-businesses-to-adopt-ai-how-bc-companies-can-line-it-up) ### [![Paper-cut illustration of colleagues assigning and reviewing an AI task with the Royal Ontario Museum in Toronto behind them.](https://go.daova.ai/hs-fs/hubfs/394175950800-first-capability-rom.png?width=1774&height=887&name=394175950800-first-capability-rom.png) AI Strategy & Getting Started ROI & Transformation AI Is Becoming the 'First Hire' for Small Businesses — What BC Owners Should Do Differently](https://go.daova.ai/blog/ai-is-becoming-the-first-hire-for-small-businesses-what-bc-owners-should-do) [![DAOVA.ai](https://go.daova.ai/hs-fs/hubfs/DAOVALOGO-0929-1.png?width=2172&height=724&name=DAOVALOGO-0929-1.png "DAOVA.ai")](http://daova.ai) - [Services](https://daova.ai/#what) - [Framework](https://daova.ai/#path) - [Blog](https://go.daova.ai/blog) - [About](https://daova.ai/#trust) --- Privacy Policy · Legal · © 2026 DAOVA SOLUTIONS INC.. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Victor Sh", "url" : "https://go.daova.ai/blog/author/victor" }, "dateModified" : "2026-10-31T18:32:26.461Z", "datePublished" : "2026-10-27T15:15:00.000Z", "headline" : "Canada's Privacy Law Is Being Rewritten — What BC Small Businesses Should Do Before Bill C-36 Passes", "image" : [ "https://go.daova.ai/hubfs/397007208412-privacy-supreme-court.png" ], "mainEntityOfPage" : { "@id" : "https://go.daova.ai/blog/canadas-privacy-law-is-being-rewritten-what-bc-small-businesses-should-do", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://go.daova.ai/hubfs/DAOVALOGO-0929-1.png" }, "name" : "DAOVA SOLUTIONS INC." } } ```