Title: The PPCDA (Bill C-36) and Ontario Law Firms: What You Need to Know While the Legislative Window Remains Open

Why Your Law Firm’s Data Practices Need Review Before Federal Privacy Law Shifts

If you manage a law firm’s practice management system or handle client data workflows in Ontario, the federal privacy landscape is moving faster than most firms expect. Bill C-36, the Protecting Canadians’ Privacy and Data Act (PPCDA), remains under parliamentary review as of 2026 and has not yet received Royal Assent. However, the legislative direction is clear: federal privacy obligations are tightening significantly. Understanding the proposed framework now — while PIPEDA still governs — gives your firm a genuine transition advantage. From an infrastructure standpoint, the gap between current practice and proposed requirements is substantial enough that waiting until enactment creates unnecessary compliance risk.

What the PPCDA Proposes: A Plain-Language Definition

PPCDA (Bill C-36) status as of 2026: The Protecting Canadians’ Privacy and Data Act is proposed federal legislation currently in Parliament. It is not yet law. If enacted, it would replace PIPEDA with modernized privacy obligations, higher financial penalties, expanded individual rights over personal data, and mandatory transparency requirements for organizations that collect, use, or disclose personal information in commercial activity.

Currently, PIPEDA — the Personal Information Protection and Electronic Documents Act — governs how Canadian businesses, including law firms, handle client personal information. PIPEDA has been in place since 2001. The proposed PPCDA introduces concepts like data minimization (only collecting what you actually need), explicit consent requirements, the right to data portability, and the right to deletion. These concepts exist in regulations like Europe’s GDPR but do not carry the same weight in current PIPEDA practice.

From a sysadmin work perspective, Ontario law firms regulated under Law Society of Ontario (LSO) rules already face dual obligations: LSO confidentiality requirements and PIPEDA compliance. The Office of the Privacy Commissioner of Canada (OPC) has signaled that proposed PPCDA frameworks will increase transparency audits in regulated professions. Law firms handling sensitive personal data — financial records, litigation details, family law matters, immigration status — face particular complexity when privacy frameworks shift. This complexity centers on intake forms, document management systems, and retention workflows that must satisfy both professional conduct rules and privacy law simultaneously.

How Proposed PPCDA Obligations Map to Law Firm Operations

The PPCDA, if enacted, would introduce several obligations that affect everyday law firm operations. From an infrastructure standpoint, these are not abstract concepts — they affect your intake process, document management system, email practices, and file retention policies.

• Consent must be meaningful: The proposed framework requires that consent obtained through buried retainer language or checkbox agreements be replaced with clear, affirmative consent. Clients must understand what data is collected, why, and how long it is kept. Your retainer agreement and client intake process require review now to identify where consent language is ambiguous. In my sysadmin work reviewing law firm databases, I’ve seen consent language scattered across five different documents — retainer, intake form, privacy policy, terms, and firm handbook. The PPCDA proposes requiring one clear, standalone consent record per client.
• Data minimization becomes a documented requirement: The proposed PPCDA framework mandates that firms cannot collect client data without a defined purpose. Every data field in your practice management software, intake forms, and matter management system needs documented justification. Collecting a client’s date of birth for a commercial real estate file requires defined purpose documentation. As a systems engineer, this means your database schema and form design choices become compliance evidence. You’ll need to justify why your intake form requests a client’s social media handles or employment history.
• Right to deletion creates new operational workflows: If enacted, the PPCDA would grant clients a statutory right to request deletion of personal information under certain conditions. Law firms would need a documented process to respond within defined timeframes. The PECB course taught me that deletion workflows require coordination between: client-facing communication (managing expectations about file retention for limitation periods), document management systems (removing searchable records), and backup/archive systems (ensuring deletion is permanent). Ontario law firms must balance LSO professional obligations — which may require retaining certain client matter files — against proposed PPCDA deletion rights. This tension requires documented policy now.
• Transparency and breach notification shift: The proposed framework would require organizations to notify affected individuals of certain data breaches within defined timelines. Current PIPEDA breach notification is inconsistent; PPCDA proposes mandatory notification for breaches posing material risk. From an infrastructure standpoint, this means your firm needs documented incident response procedures, notification templates, and communication logs. CPA Canada’s recent guidance on professional data management emphasizes that law firms should establish breach response protocols before they’re required by law.

What To Do This Week

• Audit your intake forms: Print your current client intake form and retainer agreement. Highlight every data field that requests personal information. Document the specific purpose for collecting each field. If you cannot justify a field’s collection, flag it for removal before PPCDA enactment.
• Map your practice management system: Log into your PMS as an administrator. Note which client data fields are: (a) mandatory, (b) used in reporting, (c) searchable across matters, (d) exported in bulk. This inventory becomes your baseline for data minimization.
• Schedule a 15-minute call with your firm’s LSO compliance contact: Ask: “If PPCDA enacts with a two-year transition, which of our current workflows would require change?” Document their response.
• Request your document retention policy from your IT/operations contact: Review it for clients’ rights to request deletion. Identify where client file retention conflicts with proposed deletion rights.

The Compliance Advantage of Acting Now

Waiting until Bill C-36 receives Royal Assent creates two risks: (1) your firm scrambles during a compressed transition window with other practices competing for compliance resources, and (2) you miss the opportunity to align your systems with best practices before they become law. From an infrastructure standpoint, consent processes, data minimization, and deletion workflows are not quick technical fixes — they require process redesign, staff retraining, and document management system changes. Beginning that work now, while PIPEDA remains the governing framework, lets you test workflows and identify conflicts with LSO obligations before federal requirements force the timeline.