Quebec
Quebec Law 25 Explained: Canada's Strictest Privacy Law
Quebec's Law 25 is the strictest private-sector privacy law in Canada, phased in across three effective dates between September 2022 and September 2024, and it displaces the federal PIPEDA for personal information handled within Quebec.
What Is Quebec's Law 25?
Law 25 is the short name for An Act to modernize legislative provisions as regards the protection of personal information, a sweeping set of amendments to Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1). It started life as Bill 64 in the National Assembly and received royal assent on September 22, 2021.
Rather than taking effect all at once, Law 25 was deliberately staged over three years so organizations would have time to build compliance programs before the heaviest obligations landed. That staged rollout is the single most important thing to understand about the law, because a requirement that does not apply yet in one section can already be in force in another.
Quebec's reform pairs with a parallel overhaul of the public-sector Act respecting Access to documents held by public bodies, but this article focuses on the private-sector rules that affect businesses, employers, and service providers.
Law 25 applies broadly. Any enterprise that collects, holds, uses, or discloses personal information in the course of carrying on business in Quebec is covered, whether it is a large national retailer, a local clinic, a landlord, or a solo contractor with a client list. There is no revenue threshold or employee-count exemption written into the Act itself, which is a meaningful difference from some other privacy frameworks that carve out small businesses.
The Three-Phase Rollout of Law 25
Each phase added a distinct layer of obligations on top of the last. The table below summarizes what took effect on each date.
| Effective Date | What Changed |
|---|---|
| September 22, 2022 | Mandatory designation of a person in charge of the protection of personal information (privacy officer); mandatory reporting of confidentiality incidents to the CAI and to affected individuals; requirement to keep an internal incident register; expanded duty to notify the CAI of the use of biometric characteristics or measurements |
| September 22, 2023 | New consent rules, including express consent for sensitive information; transparency and privacy-policy obligations; privacy by default for technology that collects personal information; mandatory privacy impact assessments (PIAs) for certain projects; disclosure duties around automated decision-making; the right to de-indexing and cessation of dissemination |
| September 22, 2024 | The data portability right: individuals can require an organization to hand over the computerized personal information it holds about them in a structured, commonly used technological format, or send it directly to another organization |
September 22, 2022: Governance and Incident Reporting
The first phase was about accountability infrastructure. Every organization covered by the private-sector Act had to name a specific person responsible for personal information protection, by default the most senior officer if no one else is designated, and publish that person's title and contact information on request.
Alongside the privacy-officer requirement came mandatory breach reporting. Any "confidentiality incident" involving personal information, meaning unauthorized access, use, communication, or loss, that poses a risk of serious injury must be reported to the CAI and to the individuals affected, and logged in an internal incident register regardless of whether it triggers external reporting.
September 22, 2023: Consent, Transparency, and Privacy by Default
The second phase is the one most compliance guides focus on, because it touches nearly every consumer-facing process. Consent must now be manifest, free, and informed, and given for specific purposes; consent requests have to be presented separately from other terms and in clear, simple language. Collecting or using sensitive personal information, such as health data, biometric data, or information revealing ethnic origin or sexual orientation, now requires express consent.
Organizations must also publish a privacy policy in clear, simple terms and build privacy by default into any technology, product, or service that collects personal information, meaning the highest privacy setting applies automatically unless the individual chooses otherwise. Certain projects involving the collection or use of personal information, particularly outside Quebec or in connection with new information systems, now require a documented privacy impact assessment.
This phase also introduced Quebec's version of the right to de-indexing (sometimes called a right to be forgotten in this context), letting an individual ask that certain information be de-referenced or its dissemination stopped in defined circumstances, disclosure obligations when a decision about someone is based exclusively on automated processing, and a requirement to notify the CAI before putting biometric identification or verification databases into service.
September 22, 2024: The Right to Data Portability
The final phase gave individuals a data portability right. On request, an organization must provide the computerized personal information it collected from the individual in a structured, commonly used technological format, and, where technically feasible, transmit that information directly to another organization the individual designates. This is the provision that completed the three-year rollout and it is the one most likely to affect operational systems going forward, since it requires organizations to be able to export personal data in usable form rather than just delete or disclose it.
How Law 25 Is Enforced
The Commission d'acces a l'information (CAI) is Quebec's privacy regulator for both the public and private sectors. Unlike the federal Office of the Privacy Commissioner, which must go to Federal Court to obtain binding orders, the CAI can impose administrative monetary penalties directly and can also refer matters for penal prosecution, with fines that can run into the tens of millions of dollars or a percentage of worldwide turnover for the largest organizations.
Law 25 also created a private right of action: an individual whose rights under the Act are violated as a result of an unlawful infringement can sue, and Quebec courts may award punitive damages in addition to compensatory damages. This combination, a well-resourced regulator with direct penalty power plus a civil remedy for individuals, is why Law 25 is consistently described as the toughest privacy regime anywhere in Canada.
Law 25 vs. PIPEDA: Which Law Applies in Quebec?
Canada's federal private-sector privacy statute, the Personal Information Protection and Electronic Documents Act (PIPEDA), still applies across the country by default. But Quebec's private-sector law has long been recognized by the federal government as substantially similar to PIPEDA, along with Alberta's and British Columbia's equivalent statutes. That means organizations handling personal information wholly within Quebec, in the course of commercial activity, generally follow Quebec's Act (as amended by Law 25) rather than PIPEDA.
PIPEDA does not disappear entirely. It still governs personal information handled by federally regulated organizations (banks, airlines, telecommunications carriers, and similar federal works and undertakings) operating in Quebec, and it continues to apply to interprovincial and international flows of personal information. For a full comparison of PIPEDA's own consent principles and breach-reporting rules, see PIPEDA Explained and the parallel provincial regime in Alberta and BC's PIPA.
Recording, Surveillance, and Quebec Privacy Law
Law 25 governs how organizations collect, use, and disclose personal information, not the separate question of whether it is legal to record a conversation. Recording law in Quebec follows the same federal framework as the rest of Canada: Canada is a one-party consent country, so a person who is a party to a conversation can record it without the other participant's knowledge under the Criminal Code's wiretap exception.
What Law 25 adds in Quebec is a second layer that recording law alone does not address: once a recording contains someone's personal information, how that recording is stored, used, or shared afterward can trigger the same consent, transparency, and breach-reporting obligations described above, on top of privacy torts like intrusion upon seclusion. For the full picture of consent rules for recording conversations across Canada, see Canada Recording Laws.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Privacy law in Quebec and Canada changes frequently. Consult a licensed Quebec lawyer or the Commission d'acces a l'information for guidance on a specific situation.
Frequently Asked Questions
Is Quebec's Law 25 the same as the federal Bill C-27?
No. Law 25 is a Quebec provincial law that received royal assent in 2021 and finished phasing in on September 22, 2024. Bill C-27 was a separate federal bill that would have created a new federal privacy law (the CPPA) and an AI law (AIDA), but it died on the Order Paper when Parliament was prorogued on January 6, 2025, and was never revived. PIPEDA remains the operative federal private-sector privacy law. Law 25 is unaffected by C-27's death because it was never dependent on that federal bill.
Does Law 25 replace PIPEDA in Quebec?
For most private-sector activity that occurs entirely within Quebec, yes, because Quebec's private-sector Act (as amended by Law 25) is recognized as substantially similar to PIPEDA. PIPEDA still applies to federally regulated organizations and to personal information that crosses provincial or international borders.
What are the penalties for violating Law 25?
The CAI can impose administrative monetary penalties directly against organizations, and can refer serious violations for penal prosecution, with fines that scale up to a percentage of worldwide turnover for major offenders. Law 25 also created a private right of action allowing individuals to sue for damages, including punitive damages, when their rights under the Act are unlawfully infringed.
What is the data portability right that took effect September 22, 2024?
It lets an individual request the computerized personal information an organization holds about them in a structured, commonly used technological format, and, where technically feasible, have that information sent directly to another organization the individual chooses.
Do small businesses have to comply with Law 25?
Law 25 applies to any enterprise carrying on business in Quebec that collects, holds, uses, or discloses personal information, with no small-business exemption in the statute itself. The scale of obligations, such as whether a formal privacy impact assessment is required, can depend on the nature of the processing, but the core duties (privacy officer, breach reporting, consent, transparency) apply broadly.
Does Law 25 change the rules on recording conversations in Quebec?
No. Recording a conversation you are a party to remains lawful under the Criminal Code's one-party consent rule, which applies across Canada including Quebec. Law 25 instead governs what happens to the personal information contained in a recording once it exists, such as how it is stored, used, or disclosed.
Updates
The final phase of Law 25 took effect: individuals gained the right to request their personal information in a structured, commonly used technological format, and to have it transmitted directly to another organization where technically feasible.
Sources and References
- Act respecting the protection of personal information in the private sector, CQLR c P-39.1(legisquebec.gouv.qc.ca).gov
- Commission d'acces a l'information du Quebec - Principaux changements apportes par la Loi 25(cai.gouv.qc.ca).gov
- Office of the Privacy Commissioner of Canada - Provincial laws that may apply instead of PIPEDA(priv.gc.ca).gov
- Office of the Privacy Commissioner of Canada - The Personal Information Protection and Electronic Documents Act (PIPEDA)(priv.gc.ca).gov