Quebec’s private-sector privacy law was rebuilt between 2022 and 2024. It now carries some of the heaviest penalties in North America. Here is what it requires and what it changes in your business.
- Type
- Provincial law (Quebec)
- Full name
- Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25)
- Amends
- Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
- Regulator
- Commission d’accès à l’information du Québec (CAI)
- Applies to
- Every enterprise handling personal information in Quebec, with no size threshold
- Status
- Fully in force since 2024-09-22
What it is
Law 25 is the omnibus act that modernized Quebec’s private-sector privacy statute. It adds a named person in charge, governance policies, privacy impact assessments, mandatory incident reporting, stricter consent, privacy by default, transparency about automated decisions, and new rights such as portability and de-indexing.
Why it exists
The original 1994 law predated the web economy. Quebec modelled the reform on the European GDPR so that residents keep control of their information and Quebec businesses can keep trading with jurisdictions that expect equivalent protection.
Who it applies to
Any enterprise, for-profit or not, that collects, holds, uses or communicates personal information in Quebec. There is no revenue or size threshold, and employee information is covered. Federally regulated businesses such as banks and telecoms fall mainly under PIPEDA for their federal activities.
Authority and enforcement
The Commission d’accès à l’information investigates, inspects, issues orders and imposes administrative monetary penalties under its published framework. It can also start penal proceedings, and individuals can sue for damages.
- 1994
The original private-sector act comes into force, the first of its kind in North America.
- 2020-06-12
Bill 64 is introduced in the National Assembly.
- 2021-09-22
Royal assent: the act becomes SQ 2021, c. 25.
- 2022-09-22
Phase 1: person in charge (by default the highest authority), confidentiality-incident reporting and register.
- 2023-05-11
The CAI publishes its framework for administrative monetary penalties.
- 2023-09-22
Phase 2, the core: governance policies, privacy impact assessments, consent rules, privacy by default, profiling and automated-decision transparency, transfers outside Quebec, de-indexing, destruction or anonymization, penalties.
- 2024-05-30
Regulation respecting the anonymization of personal information takes effect.
- 2024-09-22
Phase 3: the right to data portability.
Systems and tools
- Consent and cookie management with tracking off by default
- Structured export of personal data for portability requests
- Notices where decisions are fully automated
- Anonymization or secure destruction at end of retention
Processes
- Privacy impact assessment before any IT project involving personal information
- Assessment and written agreement before sending data outside Quebec
- Incident register, and notices to the CAI and individuals when there is a risk of serious injury
- Access, correction, portability and de-indexing requests answered within 30 days
Governance
- Named person in charge, published on your website
- Governance policies, with a plain-language summary published
- Data inventory and retention schedule
- Service-provider contracts with privacy clauses, and staff training
If you do not comply
- Administrative penalties up to $10 million or 2% of worldwide turnover, whichever is greater
- Penal fines from $15,000 up to $25 million or 4% of worldwide turnover, doubled for a repeat offence
- Punitive damages of at least $1,000 for intentional or grossly negligent breaches
- CAI orders and published decisions
- Class actions and lasting reputational harm
- Lost contracts with clients that audit their suppliers
Announced and upcoming changes
- No bill announcedNo amendment to the act was announced as of 2026-10-03. Expect more CAI guidance and enforcement decisions.
- WatchBill C-36 at the federal level could change how PIPEDA interacts with Quebec’s regime for cross-border activity.
Status checked 2026-10-03. Dates can move; confirm with the official sources below.
- Act respecting the protection of personal information in the private sector (LégisQuébec) ↗
- Commission d’accès à l’information du Québec ↗
- CAI framework for administrative monetary penalties (PDF, FR) ↗
- Bill 64, as introduced (National Assembly) ↗
Related insights
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how…
Read the insight →ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what…
Read the insight →Consumer-driven banking: the security bar for fintechs and payment providers
Canada's open banking regulations were proposed on 2026-06-27. Who must participate, the four accreditation pathways, the security and breach-reporting requirements, and how RPAA-registered PSPs…
Read the insight →