Loading...
Law 25 rewrote Québec's private-sector privacy rules in phases between 2022 and 2024. Here is what the law actually requires, what non-compliance can cost, and a prioritised action list for small and mid-sized businesses.
If your organisation does business in Québec and holds any personal information — about customers, employees, prospects or suppliers — Law 25 applies to you, whether you have 5 employees or 5,000. This guide explains what the law is, what it requires, and the concrete steps most small and mid-sized businesses still need to take. It is general information, not legal advice; the statute itself and the guidance of the Commission d'accès à l'information (CAI) are linked throughout.
"Law 25" is the everyday name of the Act to modernize legislative provisions as regards the protection of personal information, chapter 25 of the Statutes of Québec for 2021 — hence the name. It started life as Bill 64, was passed on 21 September 2021 and assented to on 22 September 2021. Rather than creating a new statute, it rewrote Québec's existing privacy laws, chiefly the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), which is the law private enterprises must actually follow. Section numbers below refer to that Act.
The regulator is the Commission d'accès à l'information du Québec (CAI). It can investigate on its own initiative or following a complaint, send inspectors, issue orders, impose administrative monetary penalties and bring penal proceedings.
The obligations arrived in three main waves, one year apart:
Everything is now in force. The anonymisation regulation the law anticipated has applied since 30 May 2024. As of October 2026 the obligations and penalties have not been amended since 2023, although the CAI's five-year report of June 2026 proposes further changes.
These are the obligations that matter most to a typical business.
By default this is the person with the highest authority in your organisation — the CEO or owner. The function can be delegated in writing, in whole or in part, to anyone. The title and contact information of the person in charge must be published on your website or, if you have none, made available by any other appropriate means.
You must establish and implement policies and practices that govern personal information throughout its life cycle: the roles and responsibilities of your staff, a process for handling complaints, and a framework for keeping and destroying information. They must be proportionate to the nature and scope of your activities and approved by the person in charge, and detailed information about them must be published in simple and clear language on your website.
A privacy impact assessment (PIA) is required for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information, and the person in charge must be consulted from the outset. A PIA is also required before communicating personal information outside Québec — including entrusting its storage or processing to a provider outside the province. The assessment must weigh the sensitivity of the information, the purposes, the protection measures (including contractual ones) and the legal framework of the destination; the communication may proceed only if the information will receive adequate protection, and it must be the subject of a written agreement. The CAI reads "outside Québec" as including other Canadian provinces, not only other countries.
When you collect personal information you must inform the person, in clear and simple language, of the purposes, the means of collection, their rights of access and rectification, their right to withdraw consent and, where applicable, the name of any third party for whom the information is being collected, the persons to whom it is necessary to communicate it and the possibility that it could be communicated outside Québec. If you use technology that can identify, locate or profile a person, you must say so first and explain how to activate those functions. If you collect personal information by technological means, you must publish a confidentiality policy drafted in clear and simple language on your website, and publish any notice of amendment.
Consent must be clear, free and informed, given for specific purposes, and requested for each of those purposes in clear and simple language. A written request for consent must be presented separately from any other information. When consent is needed to use sensitive information — medical, biometric or otherwise intimate information, or information that is sensitive because of its context — for a purpose other than the one for which it was collected, or to communicate it to a third party, that consent must be given expressly. Information about a minor under 14 may not be collected from the minor without the consent of the person having parental authority or the tutor, unless the collection is clearly for the minor's benefit.
If you offer the public a technological product or service that has privacy settings, those settings must provide the highest level of confidentiality by default, without any intervention by the user. Browser cookie settings are expressly excluded from this rule — but the duty to inform people about identification, location and profiling technology still applies.
If you make a decision about someone based exclusively on automated processing — a credit decision, an application screening, a pricing rule — you must inform them no later than when you communicate the decision. On request you must disclose the personal information used, the reasons and the principal factors and parameters behind the decision, and their right to have that information corrected; and they must be able to submit observations to a member of your staff who is in a position to review the decision.
Once the purposes for which personal information was collected or used are achieved, you must destroy it, or anonymise it to use it for serious and legitimate purposes, subject to any retention period set by law. Information is anonymised when it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified directly or indirectly. The anonymisation regulation in force since 30 May 2024 sets the method: defined purposes, supervision by a qualified person, a re-identification risk analysis, periodic reassessment and a register.
People have a right of access to the personal information you hold about them. Since 22 September 2024 they can also ask that computerised information collected from them — not information you created or inferred — be communicated to them, or to another person or body authorised by law to collect it, in a structured, commonly used technological format, unless doing so raises serious practical difficulties.
A confidentiality incident is any unauthorised access to, use or communication of personal information, its loss, or any other breach of its protection. When one occurs you must take reasonable measures to reduce the risk of injury and prevent further incidents, and assess whether there is a risk of serious injury, considering the sensitivity of the information, the anticipated consequences and the likelihood that it will be used for injurious purposes. If there is, you must notify the CAI promptly, and the persons concerned. Every incident — whether or not it presents a risk of serious injury — must be recorded in a register that is kept up to date, with each entry kept for at least five years after you became aware of the incident. You remain responsible even when a service provider holds the data. The CAI provides an online forms portal (in French) for declaring incidents and, since January 2026, an incident-prevention guide and checklist for businesses.
The law does not prescribe specific technologies. It requires security measures that are reasonable given the sensitivity of the information, the purposes for which it is used, its quantity and distribution, and the medium on which it is stored. In practice that is where most of the engineering work lives: access control and multi-factor authentication, encryption, backups, endpoint detection and response, logging, and contracts with your providers.
Verifying or confirming someone's identity with biometrics requires the express consent of the person and prior disclosure to the CAI, whether or not you keep a database. Creating a database of biometric characteristics or measurements must be disclosed to the CAI at least 60 days before it is brought into service. In February 2025, in the first order made under section 45, the CAI prohibited Metro Inc. from bringing a facial-recognition database into service because the identity verification it involved lacked the express consent section 44 requires. Metro has contested that decision before the Court of Québec.
The CAI is active: it received 514 confidentiality incident notices in 2024-25, up 16% on the previous year, 80% of them from the private sector. The enforcement the CAI has publicised so far consists of investigations and orders, such as the Metro decision — but its penalty powers are fully in force.
Here is the order we recommend for a business starting from little or nothing. Items 1 to 5 close the gaps that are visible from the outside, which are often the first things the CAI, insurers and customers look at; items 6 to 10 take longer and depend on how you handle data.
Compliance only holds when the policies, the technical controls and the day-to-day operations say the same thing. WeduLabs' Compliance & Privacy advisory covers Law 25 gap assessments and privacy impact assessments, the governance and incident documentation, and the security controls that back them — implemented by the engineers who operate your systems. If you want a second pair of eyes on where you stand, contact us and an engineer will get back to you.
This article provides general information about Québec law as of 29 October 2026. It is not legal advice. For advice on your situation, consult a lawyer who is a member of the Barreau du Québec.
AI systems are not just tools — they are attack surfaces. Understanding prompt injection, data exfiltration, and least-privilege access for AI is now a fundamental business requirement.
From NIS2 and DORA to AI-powered attacks and zero trust adoption, the forces reshaping cybersecurity demand a strategic response. Here is what UK IT leaders need to know.
Learn how to implement zero trust security principles in your organization, from identity verification to micro-segmentation.
Our engineers are available for a free consultation. No sales pitch — just an honest technical conversation.