Law 25 is Quebec's 2021 privacy reform, which amended the Act respecting the protection of personal information in the private sector. It requires businesses carrying on an enterprise to designate a person in charge of personal information, report serious confidentiality incidents, assess privacy risks and obtain valid consent. Penal fines can reach $25 million or, if greater, 4% of worldwide turnover.
Quebec Law 25 imposes more prescriptive private-sector privacy duties than the federal regime. For Quebec businesses, it applies directly. For Ontario companies with Quebec customers, employees or service providers, the harder question is when a Quebec statute actually reaches them. This guide explains what the law requires and where its out-of-province reach is uncertain. It also compares Law 25 with the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Current as of October 2026. Section references are to the consolidated Act respecting the protection of personal information in the private sector, CQLR c. P-39.1.
What Is Law 25 Quebec?
"Law 25" is a nickname for S.Q. 2021, c. 25 (introduced as Bill 64 and assented to on September 22, 2021), an amending statute that rewrote several existing Quebec laws. For private businesses, the operative rules now sit in the Act respecting the protection of personal information in the private sector (the "Private Sector Act"). This article cites that Act's section numbers. The regulator is the Commission d'accès à l'information du Québec (CAI), which issues guidance, receives incident reports and enforces the Act.
Does Quebec Law 25 Apply to Ontario Businesses?
Some online guides say Law 25 applies to any business with a single Quebec customer. The statute does not say that, and the honest answer is more complicated.
The statutory test
Section 1 provides that the Act applies to personal information a person "collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code." It applies whether the enterprise keeps the information itself or through a third person. Article 1525 of the Civil Code of Québec describes carrying on an enterprise as an organized economic activity, commercial or not. The activity consists of producing, administering or alienating property, or providing a service.
Section 1 does not expressly mention businesses located outside Quebec. Whether it reaches a particular Ontario business depends on how closely that business's activity is tied to Quebec.
Where the law is unsettled
The CAI is a Quebec regulator, and its authority over a business with no Quebec presence raises real jurisdiction and enforcement questions. The open question is whether a purely out-of-province business selling online to Quebec residents is subject to the Act. We have not identified a CAI or court decision that squarely settles it, and commentary on the point is not uniform.
Treat it as a risk assessment rather than a yes-or-no rule. Exposure becomes more realistic where a business has:
- A Quebec office, employees, agents or inventory
- Marketing aimed at Quebec, such as a French-language site built for Quebec customers
- A meaningful volume of Quebec customers
- Quebec-based service providers or partners
Compliance often arrives by contract
Even where direct CAI jurisdiction is doubtful, Law 25 often reaches Ontario companies through contracts. Quebec businesses must have written agreements with service providers (s. 18.3) and with anyone receiving personal information outside Quebec (s. 17), so an Ontario vendor with Quebec clients may be asked to accept Law 25-aligned terms.
For that reason, some Ontario businesses choose to adopt Law 25-level incident response and consent practices as one national standard. That is a business choice, not a legal requirement, unless the business clearly carries on an enterprise in Quebec.
Law 25 also covers employee personal information held by an enterprise in Quebec. A company with staff working in Quebec should treat their HR records as in scope. For the Ontario side, see our guide to employee monitoring rules in Ontario.
When Did Law 25 Come Into Force?
Law 25 came into force in phases on September 22 of 2022, 2023 and 2024 (section 175 of S.Q. 2021, c. 25). A few minor provisions took effect on assent in 2021. All phases are now in force.
| Date | What came into force |
|---|---|
| September 22, 2022 | Person in charge of personal information (s. 3.1); confidentiality incident duties, register and notification (ss. 3.5 to 3.8); communications for commercial transactions (s. 18.4) |
| September 22, 2023 | Most remaining obligations, including governance policies (s. 3.2), privacy impact assessments (ss. 3.3, 17), consent (s. 14), technology notices (s. 8.1), privacy by default (s. 9.1), automated decisions (s. 12.1) and the monetary administrative penalty and penal regimes |
| September 22, 2024 | Data portability in the third paragraph of s. 27 |
What Quebec Law 25 Requires: 10 Core Obligations
The Act contains no small-business exemption. Instead, some duties are expressly proportionate to the business's activities (ss. 3.2 and 3.3), so a five-person firm and a national retailer face the same rules at a different scale.
1. A person in charge of personal information (s. 3.1)
By default, the person exercising the highest authority in the enterprise, typically the CEO or owner, is the person in charge of protecting personal information. That person may delegate all or part of the function in writing. The role's title and contact information must be published on the business's website or otherwise made available.
2. Governance policies (s. 3.2)
A business must adopt policies and practices covering, at a minimum, keeping and destroying information, staff roles and responsibilities, and complaint handling. They must be proportionate to its activities, approved by the person in charge, and described publicly in simple and clear language. Our article on drafting a compliant privacy policy covers the drafting side.
3. Confidentiality incidents (ss. 3.5 to 3.8)
A "confidentiality incident" is unauthorized access to, use of or communication of personal information, or its loss or any other breach of its protection (s. 3.6). When a business has cause to believe one has occurred, it must take reasonable measures to reduce the risk of injury and prevent recurrence. If the incident "presents a risk of serious injury," it must promptly notify the CAI and the affected individuals (s. 3.5). The risk assessment considers the sensitivity of the information, the anticipated consequences of its use and the likelihood of injurious use. The person in charge must be consulted (s. 3.7).
Two points catch businesses off guard. First, the test, "risk of serious injury," is worded differently from PIPEDA's "real risk of significant harm." Second, the business must keep a register of all incidents, not only reportable ones, with a copy to the CAI on request (s. 3.8). Register and notice content are set out in Quebec's Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1), which should be reviewed alongside the CAI's incident forms.
4. Privacy impact assessments (ss. 3.3 and 17)
A privacy impact assessment (PIA) is required in two situations.
New or overhauled systems (s. 3.3). Any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information needs a PIA. The person in charge must be consulted from the outset. The assessment is proportionate to the information's sensitivity, purposes, quantity, distribution and medium.
Communication outside Quebec (s. 17). Before communicating personal information outside Quebec, the business must assess four things: the sensitivity of the information, the purposes of its use, the protection measures (including contractual ones) and the legal framework of the destination. It may proceed only if the information would receive adequate protection. A written agreement reflecting the assessment is required. The same applies when a third party outside Quebec handles or keeps information on the business's behalf.
"Outside Quebec" includes Ontario. A Quebec business using an Ontario-hosted cloud service or an Ontario payroll provider is within s. 17, which is why this provision shows up so often in vendor negotiations.
5. Consent (s. 14)
Consent must be clear, free and informed, and given for specific purposes. It must be requested for each purpose in clear and simple language and, if in writing, presented separately from other information. It lasts only as long as needed for those purposes. A minor under 14 consents through the person having parental authority or the tutor. Consent not given in accordance with the Act is without effect.
Consent must be given expressly where the information is sensitive, meaning information that, by its nature or context of use, carries a high reasonable expectation of privacy (ss. 12 and 13). Section 14 does not itself use the term "implied consent," so businesses should review the Act's provisions on secondary uses and sensitive information, and current CAI guidance, before redesigning consent flows. For marketing messages, Canada's Anti-Spam Legislation sets separate federal consent rules.
6. Privacy by default (s. 9.1)
Where a technological product or service offered to the public has privacy settings, those settings must provide the highest level of confidentiality by default. Section 9.1 expressly excludes browser cookie settings.
7. Identification, location and profiling technology (s. 8.1)
A business may collect information using technology able to identify, locate or profile a person. If so, it must inform the person of that technology and of the means to activate those functions. Section 8.1 itself defines profiling.
8. Automated decisions (s. 12.1)
Where a decision is based exclusively on automated processing, the business must inform the person no later than when it informs them of the decision. On request, it must disclose the information used, the reasons and principal factors and parameters behind the decision. It must also disclose the right to have the information corrected. The person must be able to submit observations to a staff member who can review the decision. Automated credit approvals, hiring screens and AI pricing tools with no human involvement are typical examples.
9. Access and portability (s. 27)
Individuals may access their personal information. They may also ask for computerized information collected from them, as opposed to information created or inferred about them. It must be communicated in a structured, commonly used technological format, unless that raises serious practical difficulties. At the applicant's request, that information must also be communicated to any person or body authorized by law to collect it.
10. Service providers (s. 18.3)
Personal information may be shared with a service provider without consent where needed to carry out a mandate. The mandate must be in writing and must specify the measures the provider must take to protect confidentiality, to ensure the information is used only for the mandate, and to ensure it is not kept after the mandate expires. The provider must notify the business's person in charge without delay of any violation or attempted violation of those confidentiality obligations, and must allow that person to carry out confidentiality verifications. The specified-measures requirement does not apply where the provider is a public body or a member of a professional order. These terms usually live in supplier, SaaS and data processing agreements. See our page on commercial contracts.
Law 25 Penalties: Three Separate Exposures
Law 25 created two distinct financial regimes that many summaries blur. Administrative monetary penalties are imposed by a person the CAI designates (ss. 90.1 and following). Penal fines require penal proceedings, which the CAI may institute under the Code of Penal Procedure (s. 92), and are imposed by a court. Separately, individuals can sue for punitive damages.
| Exposure | Imposed by | Individual | All other cases | Sections |
|---|---|---|---|---|
| Administrative monetary penalty | CAI (designated person) | Up to $50,000 | Up to $10,000,000 or, if greater, 2% of worldwide turnover for the preceding fiscal year | ss. 90.1, 90.12 |
| Penal fine | Court | $5,000 to $100,000 | $15,000 to $25,000,000 or, if greater, 4% of worldwide turnover for the preceding fiscal year | ss. 91, 92.1, 92.2 |
| Punitive damages | Court (civil claim) | At least $1,000 | At least $1,000 | s. 93.1 |
These are statutory maximums, not typical outcomes. A few further points:
- Triggers. Administrative penalties can follow from failing to inform individuals (ss. 7 and 8), unlawful collection, use, communication, keeping or destruction, failing to report an incident, inadequate security measures (s. 10) and breaching s. 12.1. Penal offences overlap and also include re-identifying de-identified or anonymized information, obstructing a CAI inquiry and ignoring a CAI order.
- Undertakings. A business may offer the CAI an undertaking to remedy a failure (s. 90.1, second paragraph).
- Repeat offences and limits. Penal fines double for a subsequent offence (s. 92.1), proceedings must start within five years (s. 92.2), and s. 92.3 lists sentencing factors.
- Directors and officers. Where a legal person commits an offence, an administrator, director or representative who ordered or authorized the act or omission, or consented to it, is a party to the offence and liable to the prescribed penalty (s. 93).
- Punitive damages. An intentional or grossly negligent unlawful infringement of a right under the Act that causes injury leads to punitive damages of not less than $1,000 (s. 93.1).
Law 25 vs PIPEDA
Ontario has no general private-sector privacy statute, so PIPEDA is the main privacy law for most Ontario businesses. A federal exemption order removes purely intra-Quebec private-sector activity from PIPEDA. PIPEDA still applies to information crossing provincial or national borders and to federal works and undertakings. Under s. 26(2)(b) of PIPEDA, the Governor in Council may exempt organizations from Part 1 for collection, use or disclosure of personal information that occurs within a province whose legislation is substantially similar. An Ontario business with Quebec customers is therefore subject to PIPEDA and, depending on the s. 1 analysis above, may also be subject to Law 25.
| Topic | Law 25 (Private Sector Act) | PIPEDA |
|---|---|---|
| Scope | Carrying on an enterprise (s. 1) | Commercial activities, plus federal works and undertakings |
| Accountability | Highest authority is person in charge by default (s. 3.1); published policies (s. 3.2) | Designated accountable individual; less prescriptive policy rules |
| Breach threshold | "Risk of serious injury" (s. 3.5) | "Real risk of significant harm" (s. 10.1) |
| Breach records | Register of all incidents (s. 3.8) | Record of every breach (s. 10.3), kept 24 months under the Breach of Security Safeguards Regulations |
| Privacy impact assessments | Express (ss. 3.3, 17) | No express statutory requirement |
| Transfers out of jurisdiction | PIA plus written agreement (s. 17) | Accountability approach; transferring organization stays responsible |
| Automated decisions | Express rights (s. 12.1) | No express provision at present |
| Portability | Express right (s. 27) | No express right |
| Penalties | AMPs up to $10M or 2%; penal fines up to $25M or 4% (greater amount applies) | Knowing contravention of the breach reporting, notification or record-keeping provisions, or obstruction of the Commissioner, is an offence (s. 28): fine up to $10,000 on summary conviction or up to $100,000 on indictment. The Act gives the Commissioner no order-making or penalty power |
| Private remedies | Punitive damages of at least $1,000 (s. 93.1) | Federal Court may award damages after a complaint is investigated (ss. 14 and 16) |
The practical takeaway: Law 25 is more prescriptive than PIPEDA in several areas shown above, so a program built to Law 25 may address many PIPEDA requirements, while a PIPEDA-only program will not address those Law 25 duties. Each program should still be checked against both statutes.
Law 25 Compliance Checklist for Ontario Businesses
This list is a starting point for discussion with counsel, not a complete program.
- Map Quebec customers, employees and suppliers, and the personal information held about each.
- Assess your Quebec footprint: offices, staff, targeted marketing and customer volume.
- Designate and publish a person in charge of personal information.
- Adopt and publish plain-language governance policies.
- Build an incident response plan and an incident register.
- Prepare a PIA template for new systems and for transfers of Quebec data outside Quebec.
- Update vendor and customer contracts for s. 17 and s. 18.3 terms.
- Review consent flows, cookie practices and default privacy settings.
- Identify fully automated decisions and set up notice and review procedures.
- Set up access and portability procedures, and train staff to recognize requests.
Frequently Asked Questions
Does Quebec Law 25 apply to small businesses?
Yes. Section 1 contains no size threshold, so Quebec Law 25 covers small businesses that carry on an enterprise. Size changes the depth of the program, not whether it applies, because policies and PIAs must be proportionate (ss. 3.2 and 3.3). A small business still needs a person in charge, an incident register and valid consent.
Does Law 25 require a cookie banner?
The Act does not mention cookie banners. The relevant rules are s. 8.1 (notice of identification, location or profiling technology) and s. 14 (valid consent), while s. 9.1 excludes browser cookie settings from privacy by default. Whether a site needs an opt-in banner depends on what its trackers do, so check current CAI guidance.
How quickly must a Law 25 incident be reported?
Section 3.5 requires "prompt" notice to the CAI and affected individuals once an incident presents a risk of serious injury. The Act sets no fixed number of hours or days. Businesses should assess and notify quickly, and record every incident in the register whether or not it is reportable (s. 3.8).
This article provides general information about Quebec and Canadian privacy law and is not legal advice. Hadri Law's lawyers are licensed in Ontario; questions that turn on Quebec law may require advice from a member of the Barreau du Québec. Speak with a lawyer about your specific circumstances.
Sources & Official Resources
Quebec Statutes and Regulations Cited
- Act respecting the protection of personal information in the private sector, CQLR c. P-39.1
- An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25 (Bill 64)
- Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1
- Civil Code of Québec, art. 1525
Federal Statutes and Regulations Cited 5. Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 6. Breach of Security Safeguards Regulations, SOR/2018-64
Helpful Resources 7. Commission d'accès à l'information du Québec 8. Office of the Privacy Commissioner of Canada
Contact Hadri Law
Does your business sell to, employ people in, or use service providers in Quebec? If you are unsure how Law 25 applies, a review of your contracts and privacy practices is a practical first step. Hadri Law was founded by Nassira El Hadri, a corporate and commercial lawyer called to the Law Society of Ontario. The firm advises on commercial contracts, vendor and data processing agreements and cross-border business from First Canadian Place in Toronto. Where a question turns on Quebec law, we can help you identify when Quebec counsel should be involved.
Call +1 (437) 974-2374 or book a free consultation. We serve clients in English, French, Spanish and Catalan, which matters when your customers, partners and regulator work in French.
