Definition
Quebec Law 25
In one sentence
Quebec Law 25 is the Quebec statute, formerly Bill 64, that modernized the province's private-sector privacy law, adding obligations such as a designated privacy officer, mandatory confidentiality incident reporting, privacy impact assessments and significant penalties.
Commission d'accès à l'information du QuébecPrivacy impact assessmentPersonal Information Protection and Electronic Documents ActBreach record
Quebec Law 25 Explained
Law 25 amended Quebec's Act respecting the protection of personal information in the private sector and came into force in phases on September 22 of 2022, 2023 and 2024. It is widely considered the most demanding private-sector privacy regime in Canada.
Key obligations include designating a person in charge of the protection of personal information, by default the person with the highest authority, and publishing their title and contact details; reporting confidentiality incidents that present a risk of serious injury to the Commission d'accès à l'information and to affected persons; keeping a register of all confidentiality incidents; conducting privacy impact assessments for new information systems and before communicating personal information outside Quebec; clearer consent; privacy by default; transparency about automated decisions; and data portability.
The CAI can impose administrative monetary penalties of up to CAD 10 million or 2 percent of worldwide turnover, and penal fines can reach CAD 25 million or 4 percent. Businesses outside Quebec that handle Quebec residents' information should assess whether the law applies to them.
General information for Canadian organizations, not legal advice.