Vision, mission, raison d’être and operating context – 2025–26 Departmental Results Report

Vision, mission, raison d’être

As an agent of Parliament, the Privacy Commissioner of Canada reports directly to the House of Commons and the Senate. The mandate of the Office of the Privacy Commissioner of Canada (OPC) is to oversee compliance with both the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law, along with some aspects of Canada’s anti-spam legislation (CASL). The OPC’s mission is to protect and promote the privacy rights of individuals.

The Privacy Commissioner’s powers to further the privacy rights of Canadians include:

• investigating complaints, conducting audits and pursuing court action under the authority of the Privacy Act and PIPEDA;
• publicly reporting on the personal information-handling practices of public and private sector organizations;
• supporting, undertaking and publishing research into privacy issues; and
• promoting public awareness and understanding of privacy issues, including appearing before Parliament on proposed legislation and studies on issues affecting the privacy rights of Canadians.

The Commissioner works independently of government to investigate federal public sector-related complaints from individuals under the Privacy Act, and complaints related to the private sector under PIPEDA. He also has some designated responsibilities to ensure compliance with CASL.

The Commissioner may address complaints through mediation and conciliation; he also has the power to summon witnesses, administer oaths, and compel the production of evidence. In cases where the investigation does not result in a voluntary agreement/resolution and remains unresolved, the Commissioner may seek an order from the Federal Court to address the situation under certain circumstances.

Operating context

The OPC operates in a rapidly changing environment – one in which an unprecedented volume of Canadians’ personal information is being collected and used. Although new and evolving technologies including artificial intelligence bring opportunities to create, connect, and innovate, they also pose new and complex issues for privacy. To protect individuals from potentially serious harms, organizations and federal institutions must consider and address these risks up front and build privacy into new technologies by design.

Against this shifting landscape, data breaches affecting the personal information of Canadians continue to be a significant concern in the federal public and private sectors. It is essential that both public institutions and private organizations prioritize information security, as serious consequences may result for individuals whose personal information is impacted by a privacy breach. Prioritizing privacy is more important than ever, and appropriate safeguards are essential. Modernizing Canada’s privacy laws is necessary to fully meet the challenges of today’s data-driven world – enabling Canadians to confidently reap the benefits of a digital society, and future-proofing businesses for success.

These challenges extend beyond national borders. Privacy is a global issue that cannot be dealt with by any one country or regulatory jurisdiction alone. Over the past year, the OPC has continued to play a larger leadership role and developed strong relationships across borders and jurisdictions. The Privacy Commissioner’s election as Chair of the Executive Committee of the Global Privacy Assembly and participation in the G7 Data Protection and Privacy Authorities Roundtable ensure that Canada is at the table to help influence the direction and future of privacy protection around the world.

Several factors influence the OPC’s capacity to effectively deliver on its mandate, including the complexity and volume of work, budget constraints, and reliance on the courts to enforce investigative findings. In 2025–26, the OPC saw a very significant increase in the number of complaints received under both the Privacy Act and PIPEDA, steadily rising over the course of the year, representing an overall increase of 82% for both Acts combined. The OPC expects that these higher volumes of complaints will be sustained in the coming years. Furthermore, in the first year of its new responsibility of reviewing and approving codes of practice under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), the OPC received more draft code of practice submissions than anticipated.

To help manage the increased volume, the OPC continued to leverage the temporary funding received for 2025–26 to reduce investigative backlogs, to conduct investigations into complex emerging technologies and novel business practices, and to carry out an in-depth review of a larger number of privacy breaches reported to it. The OPC also worked to secure additional funding, and the Government has approved a five-year extension of this funding, as announced in the Spring Economic Update 2026.

The OPC continued to prioritize efforts in areas where it can have the greatest impact on Canadians and where the highest risks exist. Central to this work was advancing its strategic priorities: maximizing the OPC’s impact; addressing the privacy implications of technologies like artificial intelligence (AI); and championing children’s privacy.

To maximize its impact, the OPC implemented its transformation plan to improve effectiveness and efficiency, streamline processes, strengthen collaboration and cohesion across the Office, support more integrated, agile and strategic approaches, and enable effective risk-taking. It created opportunities to optimize operations, amplify results, and deliver services to Canadians with the highest possible effectiveness. The OPC also advanced its internal AI strategy to strengthen its own analytical and operational capacity by launching the beta version of its internal AI service. This strategy has allowed the OPC to explore potential ways to use AI to optimize its work and service delivery, while leading by example in demonstrating how privacy can enable safe, secure, and responsible innovation.