{"id":1047,"date":"2026-10-08T23:00:00","date_gmt":"2026-10-09T06:00:00","guid":{"rendered":"https:\/\/securepathways.ca\/index.php\/2026\/10\/08\/quebec-law-25-guide-for-businesses\/"},"modified":"2026-10-14T07:03:00","modified_gmt":"2026-10-14T14:03:00","slug":"quebec-law-25-guide-for-businesses","status":"publish","type":"post","link":"https:\/\/securepathways.ca\/index.php\/2026\/10\/08\/quebec-law-25-guide-for-businesses\/","title":{"rendered":"Quebec&#8217;s Law 25 Explained: What Businesses Inside and Outside Quebec Need to Do"},"content":{"rendered":"<p>Quebec&#8217;s <strong>Law 25<\/strong> (formerly Bill 64) modernized the province&#8217;s private-sector privacy law and phased in new obligations between September 2022 and September 2024. It now sets the highest privacy bar in Canada \u2014 with penalties to match. If you have customers, users or employees in Quebec, it is worth understanding.<\/p>\n<h2>Who does Law 25 apply to?<\/h2>\n<p>Law 25 amends Quebec&#8217;s <em>Act respecting the protection of personal information in the private sector<\/em>. It applies to enterprises that collect, hold, use or communicate personal information about people in Quebec in the course of carrying on a business. Many businesses headquartered elsewhere in Canada \u2014 or outside Canada \u2014 that serve Quebec residents treat it as applying to them, and the safest approach is to assume it does.<\/p>\n<h2>The key obligations<\/h2>\n<h3>1. A person in charge of protecting personal information<\/h3>\n<p>By default this is the person with the highest authority in the enterprise (often the CEO). The role can be delegated in writing, and the person&#8217;s title and contact details must be published on your website.<\/p>\n<h3>2. Governance policies<\/h3>\n<p>You must adopt and publish, in clear and simple terms, policies describing how you govern personal information: roles and responsibilities, retention and destruction, and how complaints are handled.<\/p>\n<h3>3. Privacy impact assessments (PIAs)<\/h3>\n<p>A PIA is required before you acquire, develop or overhaul an information system or electronic service that involves personal information, and before communicating personal information <strong>outside Quebec<\/strong> \u2014 which includes using many cloud and SaaS providers. The assessment must consider the sensitivity of the data, the purpose, the safeguards and the legal framework of the destination.<\/p>\n<h3>4. Confidentiality incidents<\/h3>\n<p>If a confidentiality incident presents a <strong>risk of serious injury<\/strong>, you must promptly notify the Commission d&#8217;acc\u00e8s \u00e0 l&#8217;information (CAI) and the affected individuals. You must also keep a <strong>register of all incidents<\/strong>, regardless of severity. Our <a href=\"https:\/\/securepathways.ca\/index.php\/2026\/10\/10\/data-breach-response-plan-canada\/\">data breach response plan<\/a> covers how to prepare.<\/p>\n<h3>5. Consent and transparency<\/h3>\n<ul>\n<li>Consent must be clear, free and informed, and requested separately for each specific purpose.<\/li>\n<li>Sensitive information requires express consent.<\/li>\n<li>Consent for minors under 14 must come from a parent or guardian.<\/li>\n<li>When you collect information, you must tell people the purposes, how it will be collected, their rights, and whether it may be communicated outside Quebec.<\/li>\n<\/ul>\n<h3>6. Privacy by default<\/h3>\n<p>Technology that can identify, locate or profile a person must be <strong>turned off by default<\/strong>, and people must be informed about it. For websites this has real implications for analytics, advertising pixels and cookie banners. Products and services offered to the public must use the most privacy-protective settings by default.<\/p>\n<h3>7. Automated decisions<\/h3>\n<p>If you make a decision based exclusively on automated processing of personal information, you must inform the person and, on request, explain the information and factors used and allow them to have the decision reviewed by a human.<\/p>\n<h3>8. Individual rights<\/h3>\n<ul>\n<li>Access and correction (respond within <strong>30 days<\/strong>).<\/li>\n<li>Data portability in a structured, commonly used technological format (in force since September 2024).<\/li>\n<li>De-indexation and cessation of dissemination in certain circumstances.<\/li>\n<\/ul>\n<h3>9. Retention and destruction<\/h3>\n<p>When the purpose has been achieved, personal information must be destroyed or anonymized according to the regulations \u2014 not simply archived indefinitely.<\/p>\n<h2>Penalties<\/h2>\n<p>Law 25 introduced some of the largest privacy penalties in North America:<\/p>\n<ul>\n<li>Administrative monetary penalties of up to <strong>$10 million or 2% of worldwide turnover<\/strong>, whichever is greater.<\/li>\n<li>Penal fines of up to <strong>$25 million or 4% of worldwide turnover<\/strong>.<\/li>\n<li>A private right of action, including punitive damages of at least $1,000 for intentional or grossly negligent violations.<\/li>\n<\/ul>\n<h2>Law 25 compliance checklist<\/h2>\n<ol>\n<li>Designate (or confirm) your person in charge and publish their contact details.<\/li>\n<li>Map what personal information you hold, where it is stored and which vendors receive it.<\/li>\n<li>Publish governance policies and update your <a href=\"https:\/\/securepathways.ca\/index.php\/2026\/10\/11\/privacy-policy-checklist-canada\/\">privacy policy<\/a>.<\/li>\n<li>Review your website: are tracking and profiling tools off until the visitor opts in?<\/li>\n<li>Create a PIA template and use it for new systems and for transfers outside Quebec.<\/li>\n<li>Set up an incident register and a notification procedure.<\/li>\n<li>Prepare procedures for access, correction and portability requests \u2014 see our <a href=\"https:\/\/securepathways.ca\/index.php\/2026\/10\/13\/how-to-handle-privacy-access-requests-canada\/\">access request guide<\/a>.<\/li>\n<li>Define retention periods and a secure destruction or anonymization process.<\/li>\n<\/ol>\n<h2>Frequently asked questions<\/h2>\n<h3>Is Law 25 similar to the GDPR?<\/h3>\n<p>In many ways, yes: privacy by default, impact assessments, portability and large penalties will feel familiar to anyone who has worked with the GDPR. If you already comply with the GDPR you have a head start, but there are Quebec-specific requirements such as publishing governance policies and the PIA for transfers outside Quebec.<\/p>\n<h3>We are a small business. Does Law 25 still apply?<\/h3>\n<p>Yes. There is no general small-business exemption, though the effort expected is proportionate to the nature and volume of the information you handle.<\/p>\n<h2>Get a second pair of eyes<\/h2>\n<p>Secure Pathways helps small and mid-sized businesses turn privacy requirements into a clear, manageable routine \u2014 from privacy audits and policy templates to consent management and breach readiness. If you are not sure where you stand on Quebec Law 25, <a href=\"https:\/\/securepathways.ca\/index.php\/contact-us\/\">get in touch for a complimentary consultation<\/a>.<\/p>\n<p><em>This article is general information, not legal advice. Privacy rules change and depend on your industry and province \u2014 confirm your obligations with a qualified professional.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quebec&#8217;s Law 25 introduced Canada&#8217;s toughest privacy requirements and penalties. Here is what it requires and how to get compliant without the overwhelm.<\/p>\n","protected":false},"author":1,"featured_media":1077,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,12],"tags":[],"class_list":["post-1047","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-canadian-privacy-law","category-compliance-guides"],"_links":{"self":[{"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/posts\/1047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/comments?post=1047"}],"version-history":[{"count":2,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/posts\/1047\/revisions"}],"predecessor-version":[{"id":1071,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/posts\/1047\/revisions\/1071"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/media\/1077"}],"wp:attachment":[{"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/media?parent=1047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/categories?post=1047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securepathways.ca\/index.php\/wp-json\/wp\/v2\/tags?post=1047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}