Law 25
Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information)
The strictest privacy law in Canada, with privacy impact assessments for transfers and GDPR-level fines.
The law in brief
Quebec's Law 25 modernized the province's private-sector privacy law, the Act respecting the protection of personal information in the private sector. Phased in from 2022 to 2024, it is the strictest privacy regime in Canada: it requires a person in charge of privacy, privacy impact assessments, incident registers and reporting, privacy by default, transparency about automated decisions, and an assessment before personal information leaves Quebec.
Its penalties are at GDPR scale, and individuals can sue for punitive damages.
Who it applies to
- Enterprises that collect, hold, use or communicate personal information about individuals in Quebec in the course of carrying on an enterprise, including organizations outside Quebec.
- Quebec's public bodies are covered by a parallel law with similar changes.
- Personal information is any information that relates to a natural person and allows them to be identified, directly or indirectly.
What it requires
A person in charge of privacy
The person with the highest authority in the enterprise is responsible for protecting personal information and may delegate the role in writing; their title and contact details must be published.
Incident register and reporting
Take reasonable measures to reduce the risk of injury from a confidentiality incident, keep a register of all incidents, and promptly notify the Commission and affected persons where there is a risk of serious injury.
Privacy impact assessments
Conduct an assessment for any project to acquire, develop or overhaul an information system involving personal information, and before communicating personal information outside Quebec.
Consent and privacy by default
Obtain consent that is manifest, free, enlightened and given for specific purposes, express for sensitive information, and set technology products to the highest level of confidentiality by default.
Automated decisions
Inform people when a decision about them is based exclusively on automated processing, and on request tell them the information and main factors used and let them submit observations.
People's rights
Individuals can access and correct their information, withdraw consent, obtain a copy in a structured, commonly used technological format (portability, since September 2024), ask for de-indexation of information in certain cases, and be informed of and comment on decisions based exclusively on automated processing.
Enforcement and penalties
Administrative monetary penalties of up to C$10 million or 2% of worldwide turnover, and penal fines of up to C$25 million or 4%, whichever is greater, imposed by the Commission d'accès à l'information. Individuals can sue, with punitive damages of at least C$1,000 for intentional or grossly negligent breaches.
What to do first
- Confirm the person in charge of privacy (the chief executive by default, delegable in writing) and publish their title and contact details.
- Publish governance policies on how you handle personal information, in clear terms on your website.
- Run privacy impact assessments for new information systems and before communicating information outside Quebec.
- Keep a confidentiality incident register and report incidents with a risk of serious injury.
- Set the most private settings by default for technology products and services.
- Tell people about automated decisions and let them submit observations.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
Primary sources are being added to this entry.