M&A Lawyers Take Note: What Bill C-36 Could Mean For Transactions

In June 2026, the federal government introduced Bill C-36 to enact the Protecting Privacy and Consumer Data Act (PPCDA). A key change from the current regulatory regime is the prospect of significant liability arising from non-compliance. This key change could materially affect the privacy risks associated with M&A transactions in such a way that transaction parties may need to revisit both: (i) the scope of privacy-related due diligence; and (ii) the contractual protections negotiated to address those risks.

This blog examines some of the key considerations for dealmakers as they assess the potential implications of the PPCDA in the context of M&A transactions.

New Risks under Proposed Legislation

Penalties for Non-Compliance

The PPCDA, if enacted, will introduce the potential for significant financial consequences for non-compliance with a broad range of obligations. For example, an administrative monetary penalty of up to C$10 million or 3% of an organization’s gross global revenue may be imposed in respect of certain contraventions. Significantly, the administrative penalty could conceivably be imposed without demonstration of an intent to contravene the regulatory obligation in question.

Certain situations may attract even greater consequences: fines of up to the greater of C$25 million or 5% of an organization’s gross global revenue may apply, for example, to knowing contraventions of specified obligations under the PPCDA and to obstruction of Commissioner investigations.

It is relevant to note that the Quebec private sector privacy legislation includes penalties up $25,000,000 or 4% of worldwide turnover for the preceding fiscal year for specified categories of non-compliance. As such the risk of acquiring a target with regulatory exposure is not entirely new. However the Quebec penalties only came into effect in September 2023.

Potential Class Action Risk Tied to Regulatory Non-Compliance

The PPCDA would also introduce a private right of action, permitting individuals affected by a contravention of the PPCDA to bring an action for damages in prescribed circumstances following a finding of contravention. The language of the private right of action clause conceivably permits a class action claim to be advanced against an organization on the basis of regulatory non-compliance.

This proposed statutory cause of action (which would not limit or affect any civil remedy available under other federal or provincial law or at common law) could therefore significantly impact the potential risk of acquiring the target's exposure for non-compliance with privacy obligations under the PPCDA.

Additionally, the limitation period for this private right of action does not run from the privacy incident or discovery thereof. Rather, the proposed private right of action only arises after one or more events contemplated in the proposed statute (e.g., finding by the Commissioner, finding by the Federal Court, final decision dismissing any appeal of the finding). The 2-year limitation period therefore runs from the date of one of these prescribed events. This means that conceivably, the private right of action could be advanced several years after an incident.

Privacy Due Diligence

For the reasons set out below, the anticipated changes to the regulatory landscape will heighten the relevance of privacy due diligence and likely require a deeper dive. As part of their due diligence, for example, acquirors may need to consider issues such as the target’s privacy management program, data inventories, de-identification and anonymization practices, consent and withdrawal processes, security incidents, cross-border transfers, and automated decision-making that uses personal information. In particular, they may need to assess the sufficiency of the target's practices are they relate to certain new obligations under the PPCDA, including:

• whether the target had implemented and maintained the required program of policies, practices and procedures;
• whether the target had properly carried out a privacy impact assessment before disclosing or transferring personal information outside Canada and implemented measures to mitigate the risks identified; and
• whether the target’s use of automated decision systems complied with the PPCDA's requirements to provide a general account of their use of any automated decision system to make predictions, recommendations or decisions about individuals that could have a legal or similarly significant effect on them, and to provide affected individuals, on request, with an explanation of the prediction, recommendation or decision.

Privacy considerations have not always received the same level of attention in transaction diligence as other areas of regulatory compliance, reflecting in part the relative risk historically associated with privacy non-compliance. The introduction of the PPCDA may require a different approach. Where an acquisition may expose the purchaser to privacy compliance issues associated with the target’s historical practices, privacy diligence may need to assume a more prominent role in the overall diligence process. Dealmakers should also consider the extent to which they can appropriately rely on a target’s responses to privacy diligence questionnaires. Certain contexts may require, for example, a more detailed assessment of the target’s privacy exposure and analysis of their corresponding governance program.

Targets, in turn, should expect more rigorous diligence requests. Before going to market, they may need to proactively audit their privacy management program, remediate identified gaps and organize their data inventories, including records supporting de-identification, consent, security and cross-border practices. A well-documented program and evidence of remediation could help smooth the diligence process and protect valuation.

Representations and Warranties

It is common for transaction agreements to address privacy through broadly drafted compliance representations and warranties. The introduction of the PPCDA, however, may warrant a more tailored approach. Given the breadth and specificity of the proposed obligations, dealmakers may need to consider whether customary representations and warranties adequately address the target’s privacy practices and compliance with applicable privacy requirements, or whether more specific representations are appropriate.

Representation and warranty insurance may require similar attention. Parties should consider whether privacy-related representations are covered by the applicable policy, whether the limits of the policy will be sufficient to cover the potential scope of exposure, the extent to which any exclusions or limitations may apply, and whether heightened diligence will be required by the insurer in connection with underwriting that coverage.

Indemnity and Limits of Liability Language

 The changing privacy risk landscape may also require dealmakers to take a more considered approach to the indemnification and liability provisions in transaction documents. Parties should consider whether customary limitations on liability, including caps, baskets, survival periods and exclusions, appropriately allocate privacy-related risks between the purchaser and seller. Ultimately, the contractual allocation of risk should reflect the nature and potential consequences of privacy non-compliance identified through diligence.

New Privacy Requirement for Transactions

Further consideration in connection with transactions arises from the proposed changes to the "business transaction" exemption in PIPEDA. The PPCDA includes new rules regarding the de-identification of information in advance of sharing in connection with a contemplated business transaction. Aside from how this new restriction may change how diligence is carried out, it could give rise to risk for both parties to a transaction to the extent there is non-compliance with the provisions.

Looking Ahead

While the proposed changes to the regulatory scheme may introduce new risks associated with inheriting a target's regulatory exposure, there is good reason to begin revising the approach to privacy risk at this stage. Firstly, as set out above, Quebec private sector privacy legislation already includes penalties for non-compliance which therefore present M&A risk. Additionally, regulatory non-compliance (regardless of whether it attracts regulatory penalties) can signal a privacy class action risk, the defence of and exposure to which can be costly.

Updating diligence, data room protocols and transaction templates would help parties to identify privacy risks earlier (and corresponding regulatory or litigation exposure) and negotiate informed risk allocation.