Quebec Law 25
Also known as: Law 25, Bill 64, Loi 25, Quebec privacy law, Act to modernize legislative provisions as regards the protection of personal information
Quebec's Law 25 is the province's sweeping modernization of its private-sector privacy law, adding breach reporting, privacy impact assessments, stronger consent rules, data portability, and penalties of up to $25 million or 4% of worldwide turnover.
While much of Canada waited on federal reform, Quebec simply went ahead. As a result, it now has the strictest privacy regime in the country, and it applies to any business handling Quebecers' personal information.
Quebec Law 25, explained at three levels
At home
Think of Law 25 as house rules for anyone who borrows your belongings. A business that collects your personal information in Quebec must say why it wants it, use it only for that purpose, keep it safe, and destroy it when the purpose is done. If it loses your data in a way that could seriously hurt you, it has to tell you and the provincial regulator.
At work
Law 25 is the set of amendments that modernized Quebec's private-sector privacy act. It applies to any organization that collects personal information about people in Quebec, wherever the organization is based. It requires a named person in charge of privacy, published governance policies, specific consent, breach reporting, and impact assessments. Businesses care because fines are steep and the rules reach well beyond Quebec's borders.
At home
Law 25 works through a set of rights and defaults. Privacy by default means a technology product's most protective settings must be switched on until you change them. Consent must be requested separately for each purpose, in clear and simple terms, and sensitive data such as health information needs your express consent. If a decision about you is made solely by automated processing, you must be told, and you can ask what information and reasons led to it.
At work
Compliance under Law 25 rests on a few connected parts. The person in charge of personal information, the CEO by default, owns the program and is named on the website. Privacy impact assessments are required before acquiring or overhauling an information system that handles personal information, and before sending data outside Quebec. Every confidentiality incident goes into a register, and those posing a 'risk of serious injury' are reported to the Commission d'accès à l'information and to the people affected.
At home
Law 25 also gives you a de-indexation right. You can ask a business to stop spreading your information, or to de-index links to it, when that breaks the law or a court order, or when it causes you serious harm that outweighs the public's interest in knowing. The business must weigh factors such as whether you're a public figure and how old the information is. While it is narrower than Europe's right to erasure, in my opinion it is one of the law's most useful tools for ordinary people.
At work
Enforcement runs on two tracks. The Commission d'accès à l'information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, while penal prosecutions can reach $25 million or 4%. A private right of action adds punitive damages of at least $1,000 for intentional or grossly negligent breaches. For cloud-heavy businesses, the operational sting is the transfer assessment: every transfer outside Quebec, including to another province, must be assessed for adequate protection and backed by a written agreement.
Real-world examples
At home
Sophie, who lives in Montreal, noticed that a new fitness app had all its data-sharing settings switched off by default. When she looked into it, she learned that Law 25 requires privacy-protective defaults. She turned on only the features she actually wanted.
At work
Thomas runs IT for a Toronto-based retailer with stores in Quebec. To comply with Law 25, his team completed privacy impact assessments for its US-hosted customer database, updated the privacy policy in French and English, and set up a breach register. The work also helped them prepare for federal reform.
How it compares
| feature | Quebec Law 25 | PIPEDA |
|---|---|---|
| Applies to | Private businesses handling Quebecers' personal information | Commercial activity in most provinces, plus federally regulated businesses |
| Maximum penalties | Up to $25 million or 4% of worldwide turnover | Limited fines for specific offences |
| Privacy impact assessments | Required in many cases | Recommended, not generally required |
| Data portability | Yes, since September 2024 | No general right |
| Automated decision transparency | Yes | No specific rule |
Law 25 is considerably stricter than PIPEDA, and many national businesses now use it as their baseline.
For analysts
If you operate anywhere in Canada, I'd build your privacy program to Law 25's standard and treat other provinces as easier cases. Running one strong program is cheaper than maintaining a patchwork, and federal reform is moving in the same direction.
History & origin
Quebec has long led on privacy: its Act respecting the protection of personal information in the private sector, passed in 1994, was the first private-sector privacy law in North America. Bill 64, which became Law 25, was adopted in September 2021 and phased in over three years. The first obligations took effect on September 22, 2022, including mandatory breach reporting and designating a person in charge of personal information (by default, the CEO). Most requirements arrived on September 22, 2023, including privacy impact assessments, privacy by default, transparency about automated decisions, and the new penalty regime. Data portability followed on September 22, 2024. The regulator is the Commission d'accès à l'information. In my view, Law 25 quietly became Canada's de facto national standard, because few businesses want to run two privacy programs.