CPPA Reform 2025 Readiness: What Canadian SMBs Do While Bill C-27 Finishes

The CPPA is coming. The exact penalty ceilings and final rights will be set by the enacted bill, so do not anchor your plan to a number that may change. Anchor it to the direction: enforcement-driven federal privacy with administrative monetary penalties, plus AI obligations. Here is what a Canadian SMB IT team builds now so the transition is a re-baseline, not a rebuild.

Book a 45-minute Canadian privacy compliance review — we map your current PIPEDA baseline against the CPPA direction and hand you the seven readiness actions below. Bilingual EN/FR, no obligation.

If you finished the PIPEDA pillar intro, you already know the CPPA reform is in progress. This getting-started article is the operational read on what to do while Bill C-27 finishes its legislative path. It is deliberately CTA-heavy because readiness is a now-action, not a wait-and-see.

What Bill C-27 actually enacts

Bill C-27 — An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act — is the federal private-sector privacy reform. It reached second reading in the House of Commons, with a Charter Statement tabled on 4 November 2022. Three things come out of it:

1. The CPPA — the Consumer Privacy Protection Act, widely expected to replace PIPEDA as the federal framework for private-sector personal information, moving from PIPEDA’s guideline-based model toward an enforcement-driven model with administrative monetary penalties (AMPs). 2. A data-protection tribunal — the Personal Information and Data Protection Tribunal Act, a body to hear enforcement matters. 3. AIDA — the Artificial Intelligence and Data Act, federal obligations on the design, development, and deployment of certain AI systems, which is why civil-liberties groups raised rights concerns and why a Citizen Lab report proposed 19 amendments.

The honest hedge: the exact CPPA penalty ceiling, the final list of new individual rights, and the final AIDA obligations will be set by the enacted bill and its regulations. The OPC and Parliament records are the source of truth as it progresses. Anything you read today naming a specific dollar figure for the CPPA penalty ceiling should be treated as proposal-stage, not enacted law. Track it; do not build to a number that may move.

Why prepare now, not when it passes

The CPPA is expected to build on a PIPEDA-compliant baseline, not replace it. Data inventories, documented purposes, consent records, breach logs, and vendor contracts you build under PIPEDA today are the foundation the CPPA will govern tomorrow. An SMB that is still struggling with PIPEDA when the CPPA takes effect faces a disruptive transition; an SMB that is PIPEDA-compliant faces a re-baseline.

There is also the AI dimension. If your SMB uses or builds AI systems that process personal information, AIDA obligations will layer on top of the CPPA. Starting your AI-governance documentation now — what data trains what system, for what purpose, with what safeguards — is work that pays under either regime. See our ISO 27001 ↔ ISO 42001 joint implementation guide for the AI-governance overlay.

Seven readiness actions (PIPEDA-good today, CPPA-ready tomorrow)

1. Lock the data inventory. PIPEDA already requires you to know what personal information you collect, where it lives, who has access, and for what purpose (Schedule 1 Principles 2 and 4). The CPPA direction is stricter accountability. A complete, current inventory is the single highest-leverage artifact you can produce this quarter. Start the PIPEDA SMB compliance checklist.

2. Document every purpose at the collection point. Per the consent deep-dive, PIPEDA requires purposes identified at or before collection (4.2). The CPPA direction strengthens the consent default. State the purpose on the form itself, in plain language — not in a linked policy.

3. Stand up the breach register and the 72-hour target. PIPEDA requires recording every breach of security safeguards and reporting RNSH breaches “as soon as feasible.” The CPPA direction is enforcement-driven, so build to the 72-hour internal target now; it satisfies PIPEDA’s promptness and matches the cross-border expectation. See PIPEDA vs Loi 25 vs GDPR for the multi-regime incident runbook.

4. Publish a named privacy officer. PIPEDA’s Principle 4.1 requires an accountable individual. Loi 25’s art. 3.1 already requires a named officer with published contact for Quebec operations. The CPPA direction tightens accountability. One named, published officer satisfies all three.

5. Harden consent to GDPR-grade. Build consent that is freely given, specific, granular, and withdrawable — separate optional consents from service-fulfilment consent (PIPEDA 4.3.3), provide a withdrawal path (4.3.7), and scale form by sensitivity (4.3.4). GDPR-grade consent satisfies PIPEDA today and is the CPPA direction.

6. Wire vendor and transfer contracts. PIPEDA’s accountability principle expects a comparable level of protection when data leaves your control. The CPPA direction keeps accountability central. Put comparable-protection clauses in every vendor contract and complete an impact assessment for cross-border transfers (Loi 25 already requires an EFVP; the CPPA direction is the same posture).

7. Start the AI-governance record. If you use or build AI that touches personal information, document: the system, the training data and its source, the purpose, the safeguards, and the human-in-the-loop. This is the AIDA direction and it is also good PIPEDA practice (purpose + safeguards). Begin now; it is the hardest artifact to retrofit.

What to track (and where)

• **The OPC** — Office of the Privacy Commissioner of Canada guidance as the CPPA progresses.
• **Parliament records (LEGISinfo, Bill C-27)** — stage, amendments, and the final enacted text.
• **The Charter Statement** — the rights framing the government has committed to uphold.

Do not build to a specific penalty ceiling you read on a blog. Build to the direction: enforcement-driven, accountability-heavy, AI-aware. The number is a consequence of compliance; it is not the plan.

Three pitfalls

1. Waiting for passage to start. Every readiness action above is PIPEDA-good now. Waiting means arriving at CPPA day one with no inventory, no consent records, and no breach register — the worst possible position. Start the inventory this week.

2. Anchoring to a proposed penalty number. The proposed figures will move through committee, Senate, and regulation. A plan built on “the fine is $X” breaks when $X changes. Build to the obligations; the fine takes care of itself.

3. Ignoring AIDA because it is “AI”. If you deploy any AI system that processes personal information, AIDA is your problem too. The AI-governance record is the same artifact you need for CPPA accountability and PIPEDA purpose documentation. Build it once.

CTA

The CPPA is a direction, not a deadline you can wait out. Seven actions, all PIPEDA-good today, all CPPA-ready tomorrow. Book a 45-minute Canadian privacy compliance review — we map your baseline against the seven actions, flag the gaps, and hand you a prioritized roadmap. Bilingual EN/FR, no obligation. Or start with the PIPEDA SMB compliance checklist. Cross-pillar reads: PIPEDA consent and purpose, PIPEDA vs Loi 25 vs GDPR, ISO 27001 ↔ ISO 42001 joint implementation.

Sources

• **Bill C-27 (LEGISinfo, Parliament of Canada)** — *An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act*; reached second reading in the House of Commons; Charter Statement tabled 4 November 2022; federal private-sector privacy reform expected to replace PIPEDA with an enforcement-driven framework (CPPA + tribunal + AIDA).
• **PIPEDA statute (Justice Laws, chapter P-8.6), Schedule 1** — the baseline the CPPA builds on: Principles 2 (Identifying Purposes, 4.2), 3 (Consent, 4.3.1–4.3.7), 4.1 (Accountability), the "real risk of significant harm" breach threshold and "as soon as feasible" notification, and the mandatory breach-record requirement.
• **OPC (Office of the Privacy Commissioner of Canada)** — guidance on PIPEDA today and the CPPA direction as the reform progresses.
• **Citizen Lab report + civil-liberties commentary** — the 19 proposed amendments and the rights concerns over AIDA, flagged to confirm AIDA is a live obligation layer, not a footnote.
• **Hedge note:** the exact CPPA penalty ceiling, the final list of new individual rights, and the final AIDA obligations are outside the current source set and will be set by the enacted bill and its regulations. Verify against the OPC and Parliament records before you ship your compliance deadline; do not anchor your plan to a proposal-stage dollar figure.