What is Law 25?
Adopted in September 2021, Law 25 modernises Quebec's private-sector privacy statute. It introduces sweeping changes that substantially strengthen the privacy rights of Quebec residents.
The law draws heavily on Europe's GDPR and goes further than the federal PIPEDA, imposing stricter obligations on businesses.
Coming into force in three phases
Law 25 took effect in three stages:
- 22 September 2022 — First provisions: duty to report incidents, an incident register, governance policies, and a designated privacy officer.
- 22 September 2023 — Stronger transparency: explicit consent required, right to data portability, right to de-indexing, and rules on automated decision-making.
- 22 September 2024 — Final phase: privacy impact assessments mandatory for any new information system, administrative monetary penalties fully in force (up to $25M or 4% of global turnover), and a framework for workplace surveillance technologies.
Who is covered?
Law 25 applies to:
- All private-sector businesses carrying on activities in Quebec
- Quebec public bodies, under specific provisions
- Small businesses and self-employed workers included
Unlike PIPEDA, which mainly reaches large federally regulated undertakings, Law 25 touches virtually every Quebec organisation.
New obligations for businesses
1. A designated privacy officer
Every business must name a person responsible for protecting personal information and publish their contact details on its website or in its policies.
2. Governance policies and practices
Businesses must establish and implement written policies governing how personal information is handled — collection, use, retention, destruction and disclosure.
3. Privacy impact assessments (PIAs)
Since September 2024, any acquisition, development or redesign of an information system involving personal information requires a prior PIA. The assessment must analyse privacy risks and identify mitigation measures. It must be documented and retained.
4. An incident register
Every organisation must keep a register of all confidentiality incidents, however minor — a simple mis-sent email belongs in it.
5. Reporting incidents of serious harm
Where an incident presents a risk of serious injury, the business must notify the Commission d'accès à l'information (CAI) and the people affected without delay. The CAI can order corrective measures or impose penalties.
Your rights, strengthened
Right to portability — you can ask for your personal information in a structured, commonly used, interoperable format.
Right to de-referencing — you can ask that a hyperlink leading to information about you stop appearing in results for a search on your name.
Right to de-indexing — in certain cases, you can ask that your personal information be removed from a search engine.
Free and informed consent — consent must be requested clearly and simply, and you must be able to withdraw it easily.
Penalties and fines
Law 25 introduces significant administrative monetary penalties:
- Up to $10 million or 2% of global turnover for certain infringements
- Up to $25 million or 4% of global turnover for the most serious infringements
These are among the harshest in North America, and they are meant to force businesses to take their obligations seriously.
Transferring data outside Quebec
Law 25 imposes strict conditions on moving personal information out of Quebec:
- A duty to inform the person concerned clearly
- Equivalent protection measures must be in place
- Supplier contracts must include protection clauses
The Commission d'accès à l'information
The CAI is the Quebec body responsible for enforcing Law 25. Its powers have been strengthened:
- Investigate complaints, and on its own initiative
- Impose administrative monetary penalties
- Order corrective measures
- Carry out compliance audits
CAI website: www.cai.gouv.qc.ca
How Law 25 differs from PIPEDA
The main differences between Law 25 and the federal PIPEDA:
| Aspect | Law 25 (Quebec) | PIPEDA (Canada) |
|---|---|---|
| Maximum fines | $25M or 4% of global turnover | No administrative fines |
| Mandatory officer | Yes, with public contact details | Not required |
| Privacy impact assessment | Mandatory for risky projects | Not required |
| Scope | All businesses in Quebec | Mainly federal jurisdiction |
| Authority | CAI (coercive powers) | Commissioner (ombudsman) |
How to comply
Essential steps to comply with Law 25:
- Designate a privacy officer
- Inventory the personal information you hold
- Review and update your privacy policies
- Set up an incident register
- Establish procedures for answering access requests
- Assess risks and run PIAs where needed
- Train your staff
- Review contracts with suppliers and subcontractors
🏢 Is your website compliant with Law 25?
Use the free ConformitéPME tool to check in minutes whether your website meets Law 25 requirements. Built specifically for Quebec SMEs, it analyses your site and tells you what to improve.
Resources and tools
To help you understand and apply Law 25:
- Read our article on the federal PIPEDA to compare it with the provincial framework
- See our article on Bill 19 (health and social services)
- Read our article on the European GDPR, which inspired Law 25
- Free CAI training: formations.cai.gouv.qc.ca
- Official CAI guide for businesses: cai.gouv.qc.ca