Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) is the strictest private-sector privacy regime in Canada. It amended Quebec's Act respecting the protection of personal information in the private sector. If you do business in Quebec or handle Quebec residents' personal information, you need to understand it. This is general information, not legal advice.
When Did Law 25 Come into Force?
Law 25 was adopted in September 2021 and took effect in three phases:
| Date | Main requirements |
|---|---|
| September 22, 2022 | Person in charge of personal information; confidentiality incident reporting and register |
| September 22, 2023 | Privacy policies, privacy impact assessments, consent rules, privacy by default, automated decision transparency, penalties regime |
| September 22, 2024 | Right to data portability |
What Are the Key Requirements of Law 25?
Person in charge of protection of personal information
By default this is the person with the highest authority in the business, usually the CEO, who can delegate the role in writing. Their title and contact information must be published on your website.
Confidentiality incident reporting
A confidentiality incident is any unauthorized access, use, communication or loss of personal information. If an incident presents a risk of serious injury, you must promptly notify the Commission d'accès à l'information (CAI) and the persons concerned.
Incident register
You must record every confidentiality incident, not just serious ones, and provide the register to the CAI on request.
Privacy impact assessments
A privacy impact assessment is required for projects to acquire, develop or overhaul information systems involving personal information, and before communicating personal information outside Quebec. That second point catches many businesses using cloud or SaaS providers hosted elsewhere.
Consent and transparency
Consent must be clear, free, informed and given for specific purposes. Sensitive information requires express consent. Technology that tracks, locates or profiles a person must be off by default.
Automated decisions
If you make decisions about people based solely on automated processing, you must tell them.
Data portability
Since September 2024, individuals can request their computerized personal information in a structured, commonly used technological format.
What Are the Penalties Under Law 25?
Law 25 gave the CAI power to impose administrative monetary penalties of up to CAD 10 million or 2 percent of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines imposed by courts can reach CAD 25 million or 4 percent of worldwide turnover. Individuals also have a private right of action, with punitive damages possible for intentional or grossly negligent breaches.
Does Law 25 Apply to Businesses Outside Quebec?
It applies to enterprises carrying on business in Quebec, and organizations elsewhere in Canada that collect personal information from Quebec residents should take advice on whether they are covered. A Toronto retailer with a Montreal store, or an Ottawa firm with staff in Gatineau, is very likely in scope for that activity.
How Does Law 25 Change Cybersecurity Work?
The security side is concrete:
- Map where personal information lives and who can access it.
- Make sure you can detect incidents and answer "what was accessed?" quickly. Logging matters.
- Set up the incident register and a decision process for assessing serious injury.
- Run PIAs before moving data to new cloud services or AI tools.
- Review vendor contracts for security and incident notice terms.
Our privacy compliance team helps Quebec organizations with incident registers, PIAs and the security controls behind them. For reporting across provinces, see Do I have to report a data breach in Canada? and our Quebec page.