Quebec Law 25
Law 25 is Quebec’s modernized private-sector privacy law, which imposes strict consent, transparency, and governance obligations and penalties of up to $25 million or 4% of worldwide turnover.
Law 25 (formerly Bill 64) overhauled Quebec’s *Act respecting the protection of personal information in the private sector*. Its obligations rolled out in three phases and came fully into force in September 2024. Every organization doing business in Quebec must appoint a person in charge of privacy, report confidentiality incidents, and conduct privacy impact assessments before certain projects.
Key requirements include obtaining clear, granular consent, offering data portability, honouring the "right to de-indexing," and being transparent about automated decision-making. Cross-border transfers require a documented privacy impact assessment.
Enforcement sits with the Commission d’accès à l’information, which can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4% of worldwide turnover — whichever is greater.
