Quebec’s Law 25 (formerly Bill 64) modernized the province’s private-sector privacy law and phased in new obligations between September 2022 and September 2024. It now sets the highest privacy bar in Canada — with penalties to match. If you have customers, users or employees in Quebec, it is worth understanding.
Who does Law 25 apply to?
Law 25 amends Quebec’s Act respecting the protection of personal information in the private sector. It applies to enterprises that collect, hold, use or communicate personal information about people in Quebec in the course of carrying on a business. Many businesses headquartered elsewhere in Canada — or outside Canada — that serve Quebec residents treat it as applying to them, and the safest approach is to assume it does.
The key obligations
1. A person in charge of protecting personal information
By default this is the person with the highest authority in the enterprise (often the CEO). The role can be delegated in writing, and the person’s title and contact details must be published on your website.
2. Governance policies
You must adopt and publish, in clear and simple terms, policies describing how you govern personal information: roles and responsibilities, retention and destruction, and how complaints are handled.
3. Privacy impact assessments (PIAs)
A PIA is required before you acquire, develop or overhaul an information system or electronic service that involves personal information, and before communicating personal information outside Quebec — which includes using many cloud and SaaS providers. The assessment must consider the sensitivity of the data, the purpose, the safeguards and the legal framework of the destination.
4. Confidentiality incidents
If a confidentiality incident presents a risk of serious injury, you must promptly notify the Commission d’accès à l’information (CAI) and the affected individuals. You must also keep a register of all incidents, regardless of severity. Our data breach response plan covers how to prepare.
5. Consent and transparency
- Consent must be clear, free and informed, and requested separately for each specific purpose.
- Sensitive information requires express consent.
- Consent for minors under 14 must come from a parent or guardian.
- When you collect information, you must tell people the purposes, how it will be collected, their rights, and whether it may be communicated outside Quebec.
6. Privacy by default
Technology that can identify, locate or profile a person must be turned off by default, and people must be informed about it. For websites this has real implications for analytics, advertising pixels and cookie banners. Products and services offered to the public must use the most privacy-protective settings by default.
7. Automated decisions
If you make a decision based exclusively on automated processing of personal information, you must inform the person and, on request, explain the information and factors used and allow them to have the decision reviewed by a human.
8. Individual rights
- Access and correction (respond within 30 days).
- Data portability in a structured, commonly used technological format (in force since September 2024).
- De-indexation and cessation of dissemination in certain circumstances.
9. Retention and destruction
When the purpose has been achieved, personal information must be destroyed or anonymized according to the regulations — not simply archived indefinitely.
Penalties
Law 25 introduced some of the largest privacy penalties in North America:
- Administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater.
- Penal fines of up to $25 million or 4% of worldwide turnover.
- A private right of action, including punitive damages of at least $1,000 for intentional or grossly negligent violations.
Law 25 compliance checklist
- Designate (or confirm) your person in charge and publish their contact details.
- Map what personal information you hold, where it is stored and which vendors receive it.
- Publish governance policies and update your privacy policy.
- Review your website: are tracking and profiling tools off until the visitor opts in?
- Create a PIA template and use it for new systems and for transfers outside Quebec.
- Set up an incident register and a notification procedure.
- Prepare procedures for access, correction and portability requests — see our access request guide.
- Define retention periods and a secure destruction or anonymization process.
Frequently asked questions
Is Law 25 similar to the GDPR?
In many ways, yes: privacy by default, impact assessments, portability and large penalties will feel familiar to anyone who has worked with the GDPR. If you already comply with the GDPR you have a head start, but there are Quebec-specific requirements such as publishing governance policies and the PIA for transfers outside Quebec.
We are a small business. Does Law 25 still apply?
Yes. There is no general small-business exemption, though the effort expected is proportionate to the nature and volume of the information you handle.
Get a second pair of eyes
Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine — from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on Quebec Law 25, get in touch for a complimentary consultation.
This article is general information, not legal advice. Privacy rules change and depend on your industry and province — confirm your obligations with a qualified professional.
