Quebec's Law 25 rolled out in three stages between September 2022 and September 2024, and all of it now applies. It is the strictest private-sector privacy law in Canada. Its penalty ceilings are in the GDPR range, and several of its duties have no equivalent anywhere else in North America.
Law 25 is the name most people use for An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25), introduced as Bill 64 and assented to on September 22, 2021. It amends several statutes. For businesses, the one that matters is the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), so the section numbers below refer to that Act as amended. This is not legal advice.
Who Law 25 applies to
The private-sector Act applies to any "person carrying on an enterprise" that collects, holds, uses or communicates personal information about people in Quebec. There is no revenue threshold and no minimum number of records, so a ten-person agency is covered as fully as a bank. Federally regulated businesses (banks, telecoms, airlines) and cross-border transfers stay under federal PIPEDA, and in practice many companies answer to both.
The regulator is the Commission d'accès à l'information du Québec (CAI), which handles complaints and inspections, receives incident reports, imposes administrative penalties and brings penal proceedings.
The three-phase rollout
Section 175 of Law 25 set the timetable. Most provisions came into force on September 22, 2023. A smaller set took effect a year earlier, and portability a year later.
| Date | What took effect (private sector) |
|---|---|
| September 22, 2022 | Person in charge of the protection of personal information (s. 3.1); confidentiality incident response, CAI and individual notification, and the incident register (ss. 3.5-3.8); disclosure without consent for commercial transactions and for study, research or statistics |
| September 22, 2023 | Everything else: governance policies, privacy impact assessments, new consent rules, transparency at collection, profiling and tracking technology notices, privacy by default, automated decision notices, destruction or anonymization, de-indexing, outside-Quebec transfer assessments, administrative monetary penalties, higher penal fines, punitive damages |
| September 22, 2024 | Data portability: personal information collected from the individual, in a structured, commonly used technological format (third paragraph of s. 27) |
One related regulation came later. Section 23 allows anonymization instead of destruction, but only under criteria set by regulation. The CAI pointed out that, until that regulation existed, businesses could not rely on anonymization. The Regulation respecting the anonymization of personal information was published in the Gazette officielle in May 2024 and came into force on May 30, 2024, with one section deferred to January 1, 2025.
Governance obligations
A person in charge of personal information
Under section 3.1, the person with the highest authority in the enterprise, usually the CEO, is by default the person in charge of the protection of personal information. That role can be delegated in writing to anyone, inside or outside the company. The title and contact information of the person in charge must be published on your website. Many companies picked their privacy lead or DPO in 2022, but the delegation letter is often missing. Write it and keep a copy.
Governance policies
Section 3.2 requires governance policies and practices that cover, at minimum, retention and destruction, roles and responsibilities across the information life cycle, and a complaints process. They must be proportionate to the business, approved by the person in charge, and described in plain language on your website. A generic privacy notice doesn't satisfy this. The published material needs to say how you handle retention and complaints.
Privacy impact assessments
Section 3.3 requires a privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information. The person in charge must be consulted from the start of the project. The project must also be built so that information collected from a person can be returned to them in a structured, commonly used format. The PIA can be scaled to the sensitivity, volume and purpose of the data, so a new internal tool with three fields needs less than a customer data platform.
A second PIA trigger is section 17. Before communicating personal information outside Quebec, including to other Canadian provinces, you must assess it. The assessment looks at the sensitivity of the information, the purposes, the protective measures (including contract terms), and the legal framework in the destination. The transfer can go ahead only if the assessment shows adequate protection, and it must be governed by a written agreement. For a SaaS company that hosts in the US, this means a documented transfer assessment per vendor or vendor category, tied to your data processing agreements and sub-processor list.
Confidentiality incidents and the register
Law 25 calls a breach a "confidentiality incident": unauthorized access, use or communication of personal information, or its loss or any other breach of its protection (s. 3.6). When you have cause to believe one has occurred, you must take reasonable steps to reduce the risk of injury and prevent recurrence (s. 3.5). If the incident presents a risk of serious injury, you must promptly notify the CAI and the affected individuals. The risk assessment weighs the sensitivity of the information, the anticipated consequences of its use and the likelihood of misuse, and the person in charge must be consulted (s. 3.7).
Every incident, serious or not, goes into a register (s. 3.8), which you must send to the CAI on request. The content of notices and of the register is set by regulation. Keep the register in the same system as your security incidents so nothing gets recorded twice or missed.
Consent and transparency
Law 25 tightened consent considerably (s. 14). Consent must be clear, free and informed, and given for specific purposes. It must be requested separately for each purpose in clear and simple language, and a written request must be presented separately from other information. Consent lasts only as long as needed for the purpose. Consent that doesn't meet these conditions has no effect.
- Sensitive information (medical, biometric or otherwise intimate, or information whose context creates a high expectation of privacy) requires express consent for secondary uses and for communication to third parties (ss. 12-13).
- Secondary use without consent is allowed in limited cases: a consistent purpose with a direct and relevant connection to the original, a clear benefit to the person, fraud prevention and security, delivering a requested service, or research and statistics using de-identified data. Commercial or philanthropic prospecting is expressly not a consistent purpose (s. 12).
- Minors under 14: collection requires consent from the person with parental authority or the tutor, unless the collection is clearly for the minor's benefit (s. 4.1).
- Transparency at collection: people must be told the purposes, the means of collection, their rights, and (since 2023) more detail in plain language. If you collect through technological means, you must publish a plain-language confidentiality policy on your website (s. 8.2).
- Tracking and profiling technology: if you use technology that can identify, locate or profile a person, you must tell them first and explain how to activate those functions (s. 8.1). The Act defines profiling as collecting and using personal information to assess characteristics such as work performance, economic situation, health, preferences, interests or behavior.
- Privacy by default: a technological product or service offered to the public with privacy settings must ship with the highest level of confidentiality by default (s. 9.1). Browser cookie settings are carved out of this rule. Cookies are still covered by the consent and section 8.1 rules.
Individual rights
Quebecers had access and rectification rights before 2021. Law 25 added several more. Your request workflow needs to handle all of them. The working guide to handling data subject requests covers intake and verification in more detail.
| Right | Section | What it requires in practice |
|---|---|---|
| Access | s. 27 | Confirm whether you hold information, communicate it, and provide a copy. Computerized data can be requested as a written, intelligible transcript. |
| Portability | s. 27 (in force Sept. 22, 2024) | Data collected from the person, not data you created or inferred, must be provided in a structured, commonly used technological format, to the person or to anyone authorized by law to collect it, unless this raises serious practical difficulties. |
| Rectification | s. 28 | Correct information that is inaccurate, incomplete or equivocal, or whose collection, communication or retention isn't authorized by law. |
| Cessation of dissemination and de-indexing | s. 28.1 | Stop disseminating information, or de-index a hyperlink attached to the person's name, if dissemination breaks the law or a court order. It also applies where dissemination causes serious injury to reputation or privacy that clearly outweighs the public interest and free expression, weighed against factors such as whether the person is a public figure or was a minor at the time. |
| Withdrawal of consent | s. 8 | People must be told at collection that they can withdraw consent; stop the processing that relied on it. |
| Information about automated decisions | s. 12.1 | See below. |
Automated decisions
If you make a decision based exclusively on automated processing of personal information, you must tell the person no later than when you tell them the decision. On request, you must also tell them what personal information was used, the reasons and the principal factors and parameters behind the decision, and that they can have the information corrected. They must be able to submit observations to a staff member who can review the decision (s. 12.1). Failing to give the notice or the chance to submit observations is one of the failures that can draw an administrative monetary penalty.
The hard part is usually the inventory. Credit, fraud, pricing, hiring screens and account suspensions are common places where fully automated decisions hide. Your record of processing is the natural place to flag them.
Retention, destruction and anonymization
When the purposes of collection are achieved, you must destroy the information or anonymize it, subject to any legal retention period (s. 23). Under the Act, information is anonymized only if it is reasonably foreseeable, at all times, that it irreversibly no longer allows the person to be identified directly or indirectly. It must also follow generally accepted best practices and the May 2024 regulation. De-identified data (where the person can't be identified directly) is still personal information, and you must take reasonable measures to limit the risk of re-identification (s. 12).
Penalties and enforcement
Law 25 created three layers of exposure. The figures below are taken from the enacted text.
| Mechanism | Who decides | Maximum |
|---|---|---|
| Administrative monetary penalty (ss. 90.1-90.12) | A person designated by the CAI who is not a member of its divisions | $50,000 for an individual; for any other person, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater |
| Penal offence (s. 91) | Courts, on proceedings instituted by the CAI | Individuals: $5,000 to $100,000. Others: $15,000 to $25,000,000, or 4% of worldwide turnover for the preceding fiscal year if greater. Fines double for subsequent offences (s. 92.1). |
| Punitive damages (s. 93.1) | Courts, in civil actions | At least $1,000 where an unlawful infringement of a right is intentional or results from gross fault |
Administrative penalties cover a specific list of failures (s. 90.1): not informing people as required at collection, collecting, using, communicating, keeping or destroying information unlawfully, failing to report a confidentiality incident when required, inadequate security measures, automated decision failures, and certain breaches by personal information agents. Before imposing a penalty, the designated person must first send a notice of non-compliance. A business can also offer a written undertaking to remedy the failure. If the CAI accepts the undertaking and the business keeps it, no penalty can be imposed for the acts it covers. The CAI published a general framework for applying these penalties in 2023. It sets out the criteria designated persons weigh, including the seriousness of the failure, whether it is repeated, the sensitivity of the information and the business's cooperation.
What enforcement has looked like so far
We could not find a published CAI decision imposing an administrative monetary penalty on a private enterprise under Law 25 that could be confirmed on the CAI's own site at the time of writing. Commercial sites listing "real cases" with amounts usually cite no decisions. The CAI's public material so far focuses on guidance, incident reporting, and its penalty framework. Check the CAI's decisions and news pages before relying on any claim about the size of penalties in practice.
A working checklist for Law 25
- Confirm who the person in charge is, put the delegation in writing, and publish the title and contact details on your website.
- Publish plain-language governance policies covering retention and destruction, roles, and complaints. Have the person in charge approve them.
- Add a PIA step to your intake for new systems, major overhauls and vendor onboarding. Include the portability requirement in system design reviews.
- Run transfer assessments for data leaving Quebec, and make sure each one has a written agreement behind it.
- Stand up the confidentiality incident register and a "risk of serious injury" assessment template that consults the person in charge.
- Rework consent flows: separate, per-purpose requests, express consent for sensitive data, and parental consent for children under 14.
- Audit products for privacy settings and set them to the most protective option by default, outside cookie settings.
- Disclose tracking, location and profiling functions before collection, and explain how users can turn them on.
- Inventory exclusively automated decisions and prepare the notice, explanation and human review path for each one.
- Extend your request process to portability, de-indexing and dissemination requests. See the DSR automation guide and data mapping for the plumbing.
- Set retention periods and a destruction or anonymization routine that meets the 2024 regulation.
For the federal side and the other provinces, read Canada's privacy law after Bill C-11. If you're comparing Quebec with US state laws, the California CPRA and Utah pages are a useful contrast: both have revenue thresholds, which Quebec does not. Contact details for the CAI and other regulators are in the privacy regulators directory, and who regulates privacy where explains how they divide the work.
FAQ
Does Law 25 apply to companies outside Quebec?
The Act applies to enterprises that collect, hold, use or communicate personal information about people in Quebec. Companies headquartered elsewhere that serve Quebec customers routinely treat it as applying to them. There is no revenue or volume threshold.
Is a cookie banner required?
Law 25 doesn't use the word "banner". The privacy-by-default rule in section 9.1 excludes browser cookie settings, but section 8.1 still requires you to inform people before using technology that can identify, locate or profile them, and the general consent rules still apply. In practice, most sites serving Quebec use an opt-in mechanism for non-essential tracking.
When did data portability start?
September 22, 2024, the last phase of the rollout.