Quebec Law 25
Also known as: Law 25, Bill 64, Loi 25, Quebec privacy law, Act to modernize legislative provisions as regards the protection of personal information
Quebec's Law 25 is the province's sweeping modernization of its private-sector privacy law, adding breach reporting, privacy impact assessments, stronger consent rules, data portability, and penalties of up to $25 million or 4% of worldwide turnover.
While much of Canada waited on federal reform, Quebec simply went ahead. As a result, it now has the strictest privacy regime in the country, and it applies to any business handling Quebecers' personal information.
Quebec Law 25, explained at three levels
At home
If you live in Quebec, Law 25 gives you stronger control over your personal information. Companies must ask clearly before using your data, tell you if a data breach puts you at risk, and, in many cases, give you a copy of your data in a usable format.
At work
Any business that collects personal information from people in Quebec needs to follow Law 25, even if the business is based elsewhere. That means naming someone responsible for privacy, publishing a clear privacy policy, and reporting serious breaches.
At home
Law 25 requires 'privacy by default,' meaning the most privacy-protective settings must be switched on for technology products until you choose otherwise. It also says you must be told when a decision about you is made solely by automated processing, and you can ask for the reasons behind it.
At work
Key compliance steps include a privacy impact assessment before any project involving personal information systems, and before transferring data outside Quebec; a breach register and notification process for incidents posing a 'risk of serious injury'; governance policies published online; and consent that is clear, free, informed, and given for specific purposes. Separate consent is needed for sensitive information.
At home
Law 25 includes a de-indexation right, letting you ask a business to stop disseminating your information or remove links to it when that causes serious harm. That brings Quebec closer to Europe's right to erasure. In my opinion, it's one of the law's most powerful features, though businesses can weigh it against public interest and freedom of expression.
At work
Enforcement has two tracks: administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%. There's also a private right of action with possible punitive damages for intentional or grossly negligent breaches. The cross-border transfer assessment is the operational sting for cloud-heavy businesses, since every transfer outside Quebec, including to other provinces, must be assessed for adequate protection.
Real-world examples
At home
Sophie, who lives in Montreal, noticed that a new fitness app had all its data-sharing settings switched off by default. When she looked into it, she learned that Law 25 requires privacy-protective defaults. She turned on only the features she actually wanted.
At work
Thomas runs IT for a Toronto-based retailer with stores in Quebec. To comply with Law 25, his team completed privacy impact assessments for its US-hosted customer database, updated the privacy policy in French and English, and set up a breach register. The work also helped them prepare for federal reform.
How it compares
| feature | Quebec Law 25 | PIPEDA |
|---|---|---|
| Applies to | Private businesses handling Quebecers' personal information | Commercial activity in most provinces, plus federally regulated businesses |
| Maximum penalties | Up to $25 million or 4% of worldwide turnover | Limited fines for specific offences |
| Privacy impact assessments | Required in many cases | Recommended, not generally required |
| Data portability | Yes, since September 2024 | No general right |
| Automated decision transparency | Yes | No specific rule |
Law 25 is considerably stricter than PIPEDA, and many national businesses now use it as their baseline.
For analysts
If you operate anywhere in Canada, I'd build your privacy program to Law 25's standard and treat other provinces as easier cases. Running one strong program is cheaper than maintaining a patchwork, and federal reform is moving in the same direction.
History & origin
Quebec has long led on privacy: its Act respecting the protection of personal information in the private sector, passed in 1994, was the first private-sector privacy law in North America. Bill 64, which became Law 25, was adopted in September 2021 and phased in over three years. The first obligations took effect on September 22, 2022, including mandatory breach reporting and designating a person in charge of personal information (by default, the CEO). Most requirements arrived on September 22, 2023, including privacy impact assessments, privacy by default, transparency about automated decisions, and the new penalty regime. Data portability followed on September 22, 2024. The regulator is the Commission d'accès à l'information. In my view, Law 25 quietly became Canada's de facto national standard, because few businesses want to run two privacy programs.