Vision, mission, raison d’être and operating context – 2025-26 Departmental Plan

As an agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam legislation (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.^{Footnote 1}

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

• investigating complaints, conducting audits and pursuing court action under the authority of the Privacy Act and PIPEDA;
• publicly reporting on the personal information-handling practices of public and private sector organizations;
• supporting, undertaking and publishing research into privacy issues; and
• promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act, and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

Operating context

The OPC’s operating environment is constantly evolving. In today’s rapidly changing digital landscape, technological advances are transforming our world. The adoption of new technologies by businesses, federal institutions, and individuals presents both exciting opportunities and unprecedented challenges. The rapid growth of AI and generative AI technologies is raising privacy concerns globally, requiring partnerships with other data protection authorities and regulators for a coordinated response.

Over the past decade, the frequency and complexity of breach reports from both public and private sectors have increased significantly. In the 2023-24 period, nearly 700 privacy breaches were reported by businesses to the Office, impacting about 25 million individual accounts — twice as many as the previous year, despite a similar number of breaches. For the public sector, breach reports rose by 88% in 2023-24 compared to the previous year. Additionally, ransomware and malware attacks are climbing, particularly in the private sector, with increasingly sophisticated threat actors becoming involved. Last year, 46% of all private sector breaches reported to the OPC involved cyberattacks, marking a 13% rise from the previous year.

Privacy is one of the paramount challenges of our time and the demands on the OPC are numerous. The evolution of technology and the breadth and scope of the OPC’s mandate adds complexity to the OPC’s work. Temporary funding for 2023-24 and 2024-25 was received as part of Budget 2023 to help the OPC reduce investigative backlogs and to conduct investigations into complex emerging technologies and novel business practices, as well as enable it to do an in-depth review of a larger number of breaches reported to it. This temporary funding was renewed for 2025-26 in the context of continued growth in volume and complexity of breaches and complaints.

Though the timing of law reform is uncertain, progress on efforts to modernize Canada’s privacy laws — both the private-sector law, the Personal Information Protection and Electronic Documents Act, as well as the public sector Privacy Act, which predates the Internet, remains essential. Modernizing Canada’s privacy laws is necessary to fully meet today’s challenges—enabling Canadians to confidently reap the benefits of a digital society, and future-proofing businesses for success. Data is one of the most important resources of the 21st century—and how it is managed shapes Canada’s ability to lead and thrive in today’s data-driven world. Prioritizing privacy helps create conditions for a resilient Canadian economy and a more secure and enriching digital society.

With funding received as part of Budget 2023, the OPC has been preparing the groundwork for the eventual implementation of a potential new private-sector privacy law. Although it may take some time before the OPC takes on new responsibilities, it is crucial for the Office to be prepared for swift implementation.

The current environment and context necessitate adaptability to ensure that the OPC can continue to have a meaningful impact. To that end, the OPC will continue to implement its strategic plan, focussing on maximizing the impact of the OPC, addressing the privacy implications of technology such as artificial intelligence (AI), and championing children’s privacy. Moreover, the OPC will carry out, on a priority basis, the operational and structural changes stemming from the review of its resources and structures that was undertaken in the fall of 2024 to maximize efficiencies and synergies across the Office and continue to direct resources to priority areas where it can achieve the greatest outcomes for Canadians.