Quebec Law 25 Explained: Canada's Strictest Privacy Law

Quebec's Law 25 is the strictest private-sector privacy law in Canada, phased in across three effective dates between September 2022 and September 2024, and it displaces the federal PIPEDA for personal information handled within Quebec.

What Is Quebec's Law 25?

Law 25 is the short name for An Act to modernize legislative provisions as regards the protection of personal information, a sweeping set of amendments to Quebec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1). It started life as Bill 64 in the National Assembly and received royal assent on September 22, 2021.

Rather than taking effect all at once, Law 25 was deliberately staged over three years so organizations would have time to build compliance programs before the heaviest obligations landed. That staged rollout is the single most important thing to understand about the law, because a requirement that does not apply yet in one section can already be in force in another.

Quebec's reform pairs with a parallel overhaul of the public-sector Act respecting Access to documents held by public bodies, but this article focuses on the private-sector rules that affect businesses, employers, and service providers.

Law 25 applies broadly. Any enterprise that collects, holds, uses, or discloses personal information in the course of carrying on business in Quebec is covered, whether it is a large national retailer, a local clinic, a landlord, or a solo contractor with a client list. There is no revenue threshold or employee-count exemption written into the Act itself, which is a meaningful difference from some other privacy frameworks that carve out small businesses.

The Three-Phase Rollout of Law 25

Each phase added a distinct layer of obligations on top of the last. The table below summarizes what took effect on each date.

September 22, 2022: Governance and Incident Reporting

The first phase was about accountability infrastructure. Every organization covered by the private-sector Act had to name a specific person responsible for personal information protection, by default the most senior officer if no one else is designated, and publish that person's title and contact information on request.

Alongside the privacy-officer requirement came mandatory breach reporting. Any "confidentiality incident" involving personal information, meaning unauthorized access, use, communication, or loss, that poses a risk of serious injury must be reported to the CAI and to the individuals affected, and logged in an internal incident register regardless of whether it triggers external reporting.

September 22, 2023: Consent, Transparency, and Privacy by Default

The second phase is the one most compliance guides focus on, because it touches nearly every consumer-facing process. Consent must now be manifest, free, and informed, and given for specific purposes; consent requests have to be presented separately from other terms and in clear, simple language. Collecting or using sensitive personal information, such as health data, biometric data, or information revealing ethnic origin or sexual orientation, now requires express consent.

Organizations must also publish a privacy policy in clear, simple terms and build privacy by default into any technology, product, or service that collects personal information, meaning the highest privacy setting applies automatically unless the individual chooses otherwise. Certain projects involving the collection or use of personal information, particularly outside Quebec or in connection with new information systems, now require a documented privacy impact assessment.

This phase also introduced Quebec's version of the right to de-indexing (sometimes called a right to be forgotten in this context), letting an individual ask that certain information be de-referenced or its dissemination stopped in defined circumstances, disclosure obligations when a decision about someone is based exclusively on automated processing, and a requirement to notify the CAI before putting biometric identification or verification databases into service.

September 22, 2024: The Right to Data Portability

The final phase gave individuals a data portability right. On request, an organization must provide the computerized personal information it collected from the individual in a structured, commonly used technological format, and, where technically feasible, transmit that information directly to another organization the individual designates. This is the provision that completed the three-year rollout and it is the one most likely to affect operational systems going forward, since it requires organizations to be able to export personal data in usable form rather than just delete or disclose it.

How Law 25 Is Enforced

The Commission d'acces a l'information (CAI) is Quebec's privacy regulator for both the public and private sectors. Unlike the federal Office of the Privacy Commissioner, which must go to Federal Court to obtain binding orders, the CAI can impose administrative monetary penalties directly and can also refer matters for penal prosecution, with fines that can run into the tens of millions of dollars or a percentage of worldwide turnover for the largest organizations.

Law 25 also created a private right of action: an individual whose rights under the Act are violated as a result of an unlawful infringement can sue, and Quebec courts may award punitive damages in addition to compensatory damages. This combination, a well-resourced regulator with direct penalty power plus a civil remedy for individuals, is why Law 25 is consistently described as the toughest privacy regime anywhere in Canada.

Law 25 vs. PIPEDA: Which Law Applies in Quebec?

Canada's federal private-sector privacy statute, the Personal Information Protection and Electronic Documents Act (PIPEDA), still applies across the country by default. But Quebec's private-sector law has long been recognized by the federal government as substantially similar to PIPEDA, along with Alberta's and British Columbia's equivalent statutes. That means organizations handling personal information wholly within Quebec, in the course of commercial activity, generally follow Quebec's Act (as amended by Law 25) rather than PIPEDA.

PIPEDA does not disappear entirely. It still governs personal information handled by federally regulated organizations (banks, airlines, telecommunications carriers, and similar federal works and undertakings) operating in Quebec, and it continues to apply to interprovincial and international flows of personal information. For a full comparison of PIPEDA's own consent principles and breach-reporting rules, see PIPEDA Explained and the parallel provincial regime in Alberta and BC's PIPA.

Recording, Surveillance, and Quebec Privacy Law

Law 25 governs how organizations collect, use, and disclose personal information, not the separate question of whether it is legal to record a conversation. Recording law in Quebec follows the same federal framework as the rest of Canada: Canada is a one-party consent country, so a person who is a party to a conversation can record it without the other participant's knowledge under the Criminal Code's wiretap exception.

What Law 25 adds in Quebec is a second layer that recording law alone does not address: once a recording contains someone's personal information, how that recording is stored, used, or shared afterward can trigger the same consent, transparency, and breach-reporting obligations described above, on top of privacy torts like intrusion upon seclusion. For the full picture of consent rules for recording conversations across Canada, see Canada Recording Laws.

Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Privacy law in Quebec and Canada changes frequently. Consult a licensed Quebec lawyer or the Commission d'acces a l'information for guidance on a specific situation.