Law 25
Act Respecting the Protection of Personal Information in the Private Sector (Bill 64 / Law 25)
Quebec's sweeping privacy reform — Canada's strictest
Law 25 modernized Quebec's private-sector privacy law and is the most comprehensive privacy legislation in Canada. It introduced mandatory Privacy Impact Assessments for information system projects and transfers outside Quebec, prompt notification of confidentiality incidents that present a risk of serious injury, explicit consent requirements for profiling, and the right to data portability. It applies to any organization that collects Quebec residents' personal information.
Who must comply with Law 25?
Any organization — regardless of where it is incorporated or headquartered — that collects, holds, uses, or communicates the personal information of Quebec residents. This includes non-Quebec businesses operating websites, apps, or services accessible to Quebec consumers.
Not sure if Law 25 applies? Run a free assessment →
Key obligations under Law 25
Privacy Officer Designation
Publish the name and contact of your privacy officer (or by title) on your website. This is publicly verifiable.
Privacy Impact Assessments
Conduct a PIA before any new project involving high-risk personal information processing. This is mandatory under Law 25 Phase 2.
Prompt Incident Notification
If a confidentiality incident presents a risk of serious injury, promptly notify the CAI and the persons concerned (P-39.1 s.3.5). There is no fixed number of hours.
Consent for Profiling
Explicit opt-in consent is required before using personal information for profiling, targeted advertising, or automated decision-making.
Data Portability
Individuals can request their personal information in a structured, technology-neutral format for transfer to another service provider.
Cross-border Transfer Rules
Before transferring personal information outside Quebec, conduct a privacy impact assessment and obtain a signed data transfer agreement.
Penalties & enforcement
Desjardins was fined following a 9.7M member data breach — the largest in Canadian history
Run a free Law 25 gap assessment
Complete a short guided assessment, get a scored gap report, and see exactly what you need to do to comply with Law 25 — in under 3 hours. Free forever.
Start free assessment