Canada Launches Review Of The Privacy Act: Key Issues For Consultation

On April 2, 2026 the Treasury Board launched a formal review of Canada's federal Privacy Act, the statute governing how more than 250 federal institutions handle the personal information of Canadians, accompanied by a policy paper setting out detailed reform proposals.

While the Privacy Act, which has not been substantially updated since 1983, applies to federal institutions, these proposed reforms may have significant implications for private sector entities that contract with or act as vendors to the Government of Canada. Enhanced government data protection obligations, including mandatory privacy impact assessments, breach reporting requirements, and strengthened safeguards, can result in downstream compliance obligations for third parties handling personal information on behalf of federal institutions.