Office of the Privacy Commissioner of Canada’s 2025-26 Departmental Plan

From the Privacy Commissioner of Canada

I am pleased to present the 2025-26 Departmental Plan for the Office of the Privacy Commissioner of Canada (OPC).

Data is one of the most important resources of the 21st century—and how it is managed shapes Canada’s ability to lead and thrive in today’s data-driven world.

Prioritizing privacy helps create conditions for a resilient Canadian economy and a more secure and enriching digital society.

Modernizing Canada’s privacy laws is also necessary to fully meet today’s challenges—enabling Canadians to confidently reap the benefits of a digital society, and future-proofing businesses for success.

In the year ahead, I will continue to advocate for modernized laws that recognize privacy as a fundamental right; that advance the public interest; and that foster a strong Canadian economy, including by ensuring that trade with our international partners can continue to flourish. I look forward to working with the 45^th Parliament in the weeks and months ahead to make this a reality.

When Canadians have confidence that their data is protected and used responsibly, it supports their well-being today and into the future, and fosters an environment where businesses can thrive, innovate responsibly, and earn public trust.

I will also continue focusing my efforts on advancing the three strategic priorities outlined in my strategic plan: maximizing the impact of the OPC, addressing the privacy implications of technology such as artificial intelligence (AI), and championing children’s privacy.

These priorities reflect the areas where the OPC can have the greatest impact for Canadians, and where the greatest risks lie if the issues are not addressed.

Under my first priority – to maximize the impact of my Office – I have spent the early part of this fiscal year implementing a plan to optimize the OPC’s structure and programs. My aim is to ensure the effective management of organizational resources to protect and promote privacy in an increasingly complex digital landscape, within current privacy laws and a fiscal reality which requires me to make choices.

Over the past decade, breach reports from both the public and private sectors have surged in both scale and complexity. Ransomware and malware attacks are also rising sharply, and more sophisticated threat actors are becoming involved.

My Office is currently investigating a major cyberbreach involving Global Affairs Canada, as well as a breach that affected several federal institutions that had used certain personnel relocation services over the last 24 years. I have also opened an investigation into the Canada Revenue Agency (CRA) after it reported more than 30,000 privacy breaches dating back to 2020.

I am also working collaboratively with domestic and international partners to amplify our collective impact. For instance, I currently serve as chair of the Canadian Digital Regulators Forum, which will launch an important paper on synthetic media this summer. In June 2025, I will chair the annual meeting of the G7 Data Protection and Privacy Authorities Roundtable, in the context of Canada’s G7 Presidency.

Privacy is one of the paramount challenges of our time and the demands on my Office are numerous. The OPC is feeling significant strain of a budget structure that was built in a time when the privacy landscape was very different than what it is today.

Last fall, I initiated an internal review of my Office’s resources and structures with the goal of optimizing our programs and services to better respond to the needs of Canadians and our evolving operating context, as well as increase compliance in areas with the most significant impact on privacy. Throughout this exercise, I witnessed the dedication and engagement of the workforce that we have at the OPC.

While I am confident that the changes to our organization will have a positive impact on our ability to respond more rapidly and effectively to the fast-evolving privacy landscape, I plan to continue to advocate for increased permanent funding to ensure that my Office is adequately resourced on an ongoing basis to manage the full volume and complexity of privacy issues in order to meet the needs of Canada and Canadians, and I will continue to advocate for modern privacy laws.

Canadians need and expect modernized privacy laws that support innovation and enable them to enjoy the benefits of technology with the reassurance that their personal information is being protected.

Prioritizing privacy protects Canadians. Prioritizing privacy supports Canadian businesses. Prioritizing privacy is good for Canada.

Plans to deliver on core responsibilities and internal services

Core responsibilities and internal services

• Core responsibility 1: Protection of Privacy Rights
• Internal services

Core responsibility 1: Protection of Privacy Rights

Description

Ensure the protection of privacy rights of Canadians; enforce privacy obligations by federal government institutions and private-sector organizations; provide advice to Parliament on potential privacy implications of proposed legislation and government programs; promote awareness and understanding of rights and obligations under federal privacy legislation.

Quality of life impacts

The OPC is committed to incorporating the Quality of Life Framework for Canada considerations into its work wherever possible. The Protection of Privacy Rights contributes to the Prosperity (future outlook) and Good Governance (confidence in institutions) domains. Strengthened privacy protection promotes trust in the growing digital economy and directly increases Canadians’ confidence and trust in the federal government and businesses. The OPC’s policies and program activities are also informed and developed through intersectional lenses such as fairness, inclusion, and sustainability.

Indicators, results and targets

This section presents details on the department’s indicators, the actual results from the three most recently reported fiscal years, the targets and target dates approved in 2025-26 for the Protection of Privacy Rights. Details are presented by departmental result.

Table 1: Privacy rights are respected and obligations are meet

Table 1 provides a summary of the target and actual results for each indicator associated with the results under the Protection of Privacy Rights.

Table 2: Canadians are empowered to exercise their privacy rights

Table 2 provides a summary of the target and actual results for each indicator associated with the results under the Protection of Privacy Rights.

Table 3: Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights

Table 3 provides a summary of the target and actual results for each indicator associated with the results under the Protection of Privacy Rights.

Additional information on the detailed results and performance information for the OPC’s program inventory is available on GC InfoBase.

Plans to achieve results

In 2025-26, the OPC will work to achieve its departmental results, guided by its strategic priorities as outlined in its multi-year strategic plan.

Championing children’s privacy, addressing and advocating for privacy in this time of technological change, and maximizing its impact remain the OPC’s three strategic priorities. To advance them, the Office will remain agile and continuously review and improve its internal approaches, processes and tools to identify efficiencies and ensure the effective management of organizational resources to be able to continue to protect and promote Canadians’ fundamental right to privacy in an increasingly complex and evolving digital era.

The OPC will also continue its concerted effort and collaboration across jurisdictions to advance privacy protection and the safe transfer and use of Canadians’ data. In parallel and through its compliance and promotion work, the OPC will continue to set the parameters that will help organizations innovate while building a culture of privacy in which privacy-by-design and privacy-by-default principles are built into their activities.

The following section describes the planned results for the Protection of Privacy Rights in 2025-26.

Privacy rights are respected and obligations are met

Results we plan to achieve

• Continue to focus on providing Canadians with a strong, fair, accessible and timely compliance process. 
  • Leverage temporary funding received for 2025-26 to adequately respond to privacy breaches reported by public and private sector organizations; and to investigate in a timely manner privacy complaints from the public.
  • Find creative and innovative ways to use the tools currently at its disposal to promote compliance with federal privacy laws, making sure its interventions result in added privacy protection for Canadians.
  • Adapt its compliance approaches and processes, leveraging data and business intelligence, for a greater focus on results, and make greater use of risk management to address the growing volume and complexity of compliance issues.
• Capitalize on its new organizational structure, taking full advantage of domestic and international collaboration opportunities and more integrated, evidence-based, and strategic decision-making to achieve demonstrable privacy outcomes for Canadians.
• Prioritize activities that advance the OPC’s strategic priorities, including investigations focused on emerging technologies and those where organizations collect and use children’s sensitive personal information; and continue to initiate or intervene in litigation cases that have the potential to protect and promote privacy rights and establish concrete privacy standards.
• Conclude high-impact investigations and leverage opportunities to communicate privacy law requirements and amplify OPC’s work, including findings from its investigations, to promote compliance more broadly.

Canadians are empowered to exercise their privacy rights

Results we plan to achieve

• Respond to Canadians’ need for information and advice through the development and delivery of relevant and accessible communications and information resources, targeted outreach activities, and timely responses to public inquiries.
• Make data-informed improvements to the OPC’s website—the OPC’s primary interaction point for Canadians with the OPC—to enhance the effectiveness of the OPC’s online resources and the overall user satisfaction.
• Enhance the OPC’s knowledge and expertise regarding children’s privacy and share findings across the organization and with partners to inform a consistent understanding and guide strategic initiatives focused on children’s privacy.
  • Engage directly with youth to better understand young Canadians’ online experiences related to data privacy and situate their knowledge of their privacy rights and privacy protections and resources available to them.
  • Release the results of the OPC’s 2024-25 public opinion survey on children.
  • Leverage the data and insights gained through various OPC-led consultation and engagement activities to inform OPC work aimed at promoting and protecting children’s privacy.
• Develop a framework and process for the identification of priority privacy issues that draws on business intelligence from across the OPC, to make sure that information and guidance developed by the OPC are user-centric and needs-based.

Parliamentarians, and public and private sector organizations are informed and guided to protect Canadians’ privacy rights

Results we plan to achieve

• Promote a better understanding of the rights and obligations under federal privacy legislation, through strategic OPC interventions that are informed by data, trends and issues identified in its compliance work.
• Continue to enhance internal awareness, knowledge and expertise around advanced and emerging technologies to be able to effectively address privacy challenges posed by these new technologies.
  • Exemplify how to leverage technology effectively while also protecting privacy by implementing the OPC’s internal Artificial Intelligence (AI) strategy that delivers artificial intelligence capabilities within the Office with a view to develop and expand practical AI expertise within the office and demonstrate the safe and responsible adoption of AI within the Government of Canada context.
  • Conduct internal research and develop expertise in “AI remedies” – i.e. what available and reasonable options might be considered should organizations developing or operating an AI system be found to be non-compliant with federal privacy laws.
• Prioritize research and guidance development that advance the OPC’s strategic priorities.
  • Develop guidance for organizations on age assurance and undertake a consultation to inform the development of guidance for organizations on the collection, use and disclosure of children’s data.
  • Pursue opportunities to advance the OPC’s goal to define, use and promote privacy standards for technology that are clear and practical and conduct environmental scanning of guidance and model contractual clauses in other jurisdictions.
• Foster domestic and international partnerships with regulatory authorities to share knowledge and expertise, ensure coordinated responses and harmonized approaches to privacy issues and seek opportunities to maximize external partnerships and networks to amplify impact and expand capacity. Notably, in the coming year, the OPC will host the G7 data protection regulators in June 2025, when they will work together on issues of common interest, with the goal of advancing privacy and data protection globally.
• Continue to advocate for the strengthening of Canada’s privacy laws and provide advice to Parliament to ensure that adopted laws effectively recognize, promote and protect the fundamental right to privacy while enabling responsible innovation.
  • Leverage funding received as part of Budget 2023 to prepare the groundwork for the eventual implementation of a potential new private-sector privacy law. Although it may take some time before the OPC takes on new responsibilities, it is crucial for the Office to be prepared for swift implementation. This includes continuing work to significantly reduce the backlog of complaints, while also reviewing and updating its extensive body of guidance and making refinements to its website.

Key risks

Key risks to the privacy of Canadians influence the OPC’s identification of priorities, affect plans and performance, and are factors in decision-making. The OPC continually scans its environment to ensure that it fulfills its core mandate and responds to the changing environment.

A key risk facing the organization is its capacity to meet its statutory obligations given the rapidly evolving privacy landscape, the significant increase in complexity and volume of work, fiscal constraints, increased reliance on the courts to enforce the OPC findings, and uncertainty related to the impact of its evolving mandate.

To mitigate this risk, the OPC will continue to focus on advancing its strategic priorities as outlined in its multi-year strategic plan. The realignment of the OPC’s organizational resources and structures will contribute to mitigating the OPC’s capacity risks. The OPC will also continue to seek creative ways to streamline processes, leverage partnerships to enhance impact and expand capacity, and utilize technology to bring further efficiencies in its service delivery to Canadians, all while continuing to work to protect and promote individuals’ privacy rights.

Cybersecurity risks are inherent to every organization, and the OPC is no exception. The OPC must continue to be vigilant and continually monitor these risks and invest in mechanisms to manage them effectively.

Planned resources to achieve results

Table 4: Planned resources to achieve results for the Protection of Privacy Rights

Table 4 provides a summary of the planned spending and full-time equivalents required to achieve results.

Complete financial and human resources information for the OPC’s program inventory is available on GC InfoBase.

Related government priorities

Gender-based analysis plus

The OPC fosters a culture of diversity and inclusion in order to provide the highest quality service to Canadians and enable the full participation of its employees, clients, and stakeholders in the delivery of its activities and its mandate. It recognizes the importance of Gender-Based Analysis Plus (GBA Plus) to understand the impacts of its programs and services to achieve better outcomes and supports its implementation throughout the organization. Recognizing the need for data-informed, evidence-based analysis, the Office will build on work undertaken in the last year to identify opportunities to apply a GBA Plus lens to its programs and services. This will include finalizing and commencing the implementation of a GBA Plus data collection plan, in line with its framework, that is focused on supporting the OPC’s understanding of the potential impacts of its programs and services on the public it serves, and ensuring that these programs and services are responsive to the diverse needs of Canadians.

Program inventory

The Protection of Privacy Rights is supported by the following programs:

• Compliance Program
• Promotion Program

Activities related to addressing existing compliance issues fall under the compliance program, while activities to bring departments and organizations towards compliance with the law fall under the promotion program.

Additional information related to the program inventory for the Protection of the Privacy Rights is available on the Results page on GC Infobase.

Internal services

In this section

• Description
• Plans to achieve results
• Planned resources to achieve results
• Planning for contracts awarded to Indigenous businesses

Description

Internal services are the services that are provided within a department so that it can meet its corporate obligations and deliver its programs. There are 10 categories of internal services:

• management and oversight services
• communications services
• legal services
• human resources management services
• financial management services
• information management services
• information technology services
• real property management services
• materiel management services
• acquisition management services

Communications services are an integral part of the OPC’s education and outreach mandate. As such, these services are included in the Promotion Program. Similarly, as legal services are an integral part of the OPC’s delivery of compliance activities, they are included in the Compliance Program.

Plans to achieve results

This section presents details on how the department plans to achieve results and meet targets for internal services.

To support and enable program delivery, in 2025-26, Internal Services will undertake the following key initiatives:

• Carry out, on a priority basis, the operational and structural changes stemming from the review of the OPC’s resources and structures that was undertaken in the fall of 2024 and apply change management principles to support an effective transition to its new organizational structure.
• Implement the OPC’s strategic human resources plan that aims to attract, develop and retain the right people; that fosters a respectful, diverse, inclusive and supportive work environment; and that empowers the Office to achieve ambitious goals, aligned with its strategic priorities, in the delivery of its services to Canadians.
• Develop a robust risk management framework and promote its implementation across the OPC to help make key decisions and strategic choices based on a sound understanding of the organization’s risk appetite and tolerance.
• Bolster the Office’s business intelligence capacity to accelerate opportunities to harness and leverage data for decision-making.
• Continue the important work under the Clerk’s Call to Action on Anti-Racism, Equity and Inclusion to ensure a workplace that is safe and where all employees feel well supported, valued and are treated equitably – regardless of race, gender or other unique characteristics.
• Deliver a Data Management Strategy that enumerates and manages datasets and systems that generate data within the OPC.
• Finalize and implement a service management strategy that supports the delivery of user-centric services, and enables future improvements based on modern digital approaches.

Planned resources to achieve results

Table 5: Planned resources to achieve results for internal services this year

Table 5 provides a summary of the planned spending and full-time equivalents required to achieve results.

Complete financial and human resources information for the OPC’s program inventory is available on GC InfoBase.

Planning for contracts awarded to Indigenous businesses

Government of Canada departments are to meet a target of awarding at least 5% of the total value of contracts to Indigenous businesses each year. This commitment is to be fully implemented by the end of 2024-25.

The OPC will continue to implement measures to achieve and surpass the mandatory 5% target by:

• Incorporating Indigenous procurement methods in the planning stage.
• Awarding contracts to Indigenous businesses mainly through prequalified vendors when using various standing offers and other government procurement tools.
• Increasing voluntary set-asides when Indigenous capacity exists and operational requirements, best value, prudence, probity and sound contracting management can be assured.

As a smaller organization, the OPC relies on the Canadian Human Rights Commission (CHRC) for procurement services, and we will work jointly with CHRC to achieve the target.

Table 6: Percentage of contracts planned and awarded to Indigenous businesses

Table 6 presents the current, actual results with forecasted and planned results for the total percentage of contracts the department awarded to Indigenous businesses.

Planned spending and human resources

This section provides an overview of the OPC’s planned spending and human resources for the next three fiscal years and compares planned spending for 2025-26 with actual spending from previous years.

Spending

This section presents an overview of the department’s planned expenditures from 2022-23 to 2027-28.

Budgetary performance summary

Table 7: Three-year spending summary for core responsibilities and internal services (dollars)

Table 7 presents how much money the OPC spent over the past three years to carry out its core responsibilities and for internal services. Amounts for the current fiscal year are forecasted based on spending to date.

Analysis of the past three years of spending

For the 2022-23 and 2023-24 fiscal years, actual spending represents the actual expenditures as reported in the Public Accounts of Canada.

Forecast spending for the 2024-25 fiscal year corresponds to the OPC’s planned spending. It includes funding received for the collective agreements, the inclusion of the operating budget carry-forward from 2023-24 to 2024-25, the additional temporary funding received as part of Budget 2023 to reduce the backlog of privacy complaints and to undertake more in-depth investigations of privacy breaches and the temporary funding received as part of Budget 2023 for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C-27.

More financial information from previous years is available on the Finances section of GC Infobase.

Table 8 Planned three-year spending on core responsibilities and internal services (dollars)

Table 8 presents how much money the OPC’s plans to spend over the next three years to carry out its core responsibilities and for internal services.

Analysis of the next three years of spending

Budgetary spending for the 2025-26 fiscal year corresponds to the OPC’s planned spending. It includes funding received for the collective agreements and the temporary funding received as part of Budget 2023, namely the funding for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and to undertake more in-depth investigations of privacy breaches. The reduction in planned spending for 2026-27 fiscal year and beyond is the result of the end these temporary fundings.

More detailed financial information on planned spending is available on the Finances section of GC Infobase.

Funding

This section provides an overview of the department’s voted and statutory funding for its core responsibilities and for internal services. For further information on funding authorities, consult the Government of Canada budgets and expenditures.

Graph 1: Approved funding (statutory and voted) over a six-year period

Analysis of statutory and voted funding over a six-year period

The above graph illustrates the OPC’s funding trend over a six-year period from 2022-23 to 2027-28.

Statutory spending covers annual costs for employee benefits.

Such costs may vary from year to year and are set by the Treasury Board Secretariat, based on calculated expenses and forecasts.

The figures for the 2022-23 and 2023-24 fiscal years reflect the organization’s actual expenditures, as reported in the public accounts. The figures for the 2024-25 to 2027-28 fiscal years represent planned spending.

For further information on the OPC’s departmental appropriations, consult the 2025-26 Main Estimates.

Future-oriented condensed statement of operations

The future-oriented condensed statement of operations provides an overview of the OPC’s operations for 2024-25 to 2025-26.

Table 9 Future-oriented condensed statement of operations for the year ended March 31, 2026 (dollars)

Table 9 summarizes the expenses and revenues which net to the cost of operations before government funding and transfers for 2024-25 to 2025-26. The forecast and planned amounts in this statement of operations were prepared on an accrual basis. The forecast and planned amounts presented in other sections of the Departmental Plan were prepared on an expenditure basis. Amounts may therefore differ.

Analysis of forecasted and planned results

The net cost of operations before government funding and transfers for the 2025-26 planned results is expected to increase by $919,000 when compared to the net cost of operations before government funding and transfers for the 2024-25 forecast results.

This increase is mainly explained by the temporary funding received as part of Budget 2023 for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C-27.

A more detailed Future-Oriented Statement of Operations and associated Notes for 2025-26 including a reconciliation of the net cost of operations with the requested authorities, is available on the OPC’s website.

Human resources

This section presents an overview of the department’s actual and planned human resources from 2022-23 to 2027-28.

Table 10: Actual human resources for core responsibilities and internal services

Table 10 shows a summary of human resources, in full-time equivalents, for the OPC’s core responsibilities and for its internal services for the previous three fiscal years. Human resources for the current fiscal year are forecasted based on year to date.

Analysis of human resources over the last three years

The increase in 2024-25 forecasted FTEs is due to the temporary funding received as part of Budget 2023 to reduce the backlog of privacy complaints and to undertake more in-depth investigations of privacy breaches as well as the temporary funding received as part of Budget 2023 for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C‑27.

Table 11: Human resources planning summary for core responsibilities and internal services

Table 11 shows information on human resources, in full-time equivalents, for each of the OPC’s core responsibilities and for its internal services planned for the next three years.

Analysis of human resources for the next three years

The increase in 2025-26 planned FTEs, is due to the temporary funding received as part of Budget 2023, namely the funding for preparation activities required to implement the Consumer Privacy Protection Act that was proposed as part of Bill C-27, and the funding received to reduce the backlog of privacy complaints and to undertake more in-depth investigations of privacy breaches.

Corporate information

Supplementary information tables

The following supplementary information tables are available on the OPC’s website:

• Details on transfer payment programs
• Gender-based analysis plus

Information on OPC’s departmental sustainable development strategy can be found on the OPC’s website.

Federal tax expenditures

The OPC’s Departmental Plan does not include information on tax expenditures.

The tax system can be used to achieve public policy objectives through the application of special measures such as low tax rates, exemptions, deductions, deferrals and credits. The Department of Finance Canada publishes cost estimates and projections for these measures each year in the Report on Federal Tax Expenditures.

This report also provides detailed background information on tax expenditures, including descriptions, objectives, historical information and references to related federal spending programs as well as evaluations and GBA Plus of tax expenditures.

Definitions