Quebec Law 25 coverage
Act respecting the protection of personal information in the private sector, as amended by Law 25
Quebec's private-sector privacy law, modernized by Law 25: a person in charge of personal information, privacy impact assessments, confidentiality incidents, consent and individual rights.
General information, not legal advice. Coverage reflects the product as of the last-updated date (September 12, 2026). These lists are not exhaustive — they cover the obligations most relevant to small and medium businesses, including ones the product does not cover.
Quebec Law 25 scoring and task plans are part of the Business plan. Some questions below count toward the PIPEDA score instead — each is labelled.
- Live
- 1
- Guidance
- 11
- Planned
- 1
- Not covered
- 4
17 obligations listed · 4 self-assessment questions feed the Quebec Law 25 score
How to read the status
- Live
- A shipped product feature does part of the work today.
- Guidance
- We explain it in our guides, articles or in-app knowledge centres. No tool does the work.
- Planned
- On the dated product roadmap. Not available today.
- Not covered
- No product feature and no dedicated explanation from us today. It may be mentioned in passing elsewhere.
Separately, each row shows which self-assessment questions ask about it. A question records your answer — it does not verify your practices.
Obligations
- Guidance
The person with the highest authority in the enterprise is the person in charge of the protection of personal information unless the function is delegated in writing. Publish that person’s title and contact information on your website.
Coverage
Explained in: Quebec Law 25 guide · The Law 25 privacy officer
The in-app PIPEDA & Law 25 knowledge centre includes a Privacy Officer starter kit (copyable templates, including a French contact block).
Self-assessment
- Q2 — Have you designated a Privacy Officer for your organization? (counts toward the PIPEDA score)
- Not covered
Establish and implement governance policies and practices — covering how information is kept and destroyed, staff roles, and a complaints process — and publish detailed information about them in clear and simple language.
Coverage
—
Self-assessment
Not asked
- Guidance
Conduct a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information.
Coverage
Explained in: Quebec Law 25 guide · Law 25 privacy impact assessments
The in-app knowledge centre includes a six-step "PIA Lite" worksheet. It is a starting point, not a full assessment.
Self-assessment
- Q14 — Have you conducted a Privacy Impact Assessment (PIA) for high-risk processing activities? (counts toward the Law 25 score)
- Guidance
Before communicating personal information outside Québec, conduct a privacy impact assessment, and put the communication under a written agreement.
Coverage
Explained in: Quebec Law 25 guide · Law 25 privacy impact assessments
Self-assessment
- Q8 — For personal information stored outside Canada, have you assessed the transfer and disclosed it to your users? (counts toward the Law 25 score)
- Guidance
When you believe a confidentiality incident has occurred, take reasonable measures to reduce the risk of injury. If it presents a risk of serious injury, promptly notify the Commission d’accès à l’information and the persons concerned.
Coverage
Explained in: Quebec Law 25 guide
The breach register can record whether the Commission was notified, but it does not send notifications. The in-app knowledge centre includes a breach response playbook.
Self-assessment
- Q9 — Do you have a documented data breach response plan? (counts toward the PIPEDA score)
- Live
Keep a register of confidentiality incidents, and send a copy to the Commission on request.
Coverage
Feature: Breach register: logs each incident with dates, data involved, risk assessment, containment steps and whether the Commission was notified.
The register was built around PIPEDA’s breach-record requirements. The Act allows a government regulation to set the register’s content; we have not mapped the register field by field against it.
Self-assessment
Not asked
- Guidance
Make sure consent is clear, free and informed, given for specific purposes, requested for each purpose in clear and simple language and — if requested in writing — presented separately from other information.
Coverage
Explained in: Quebec Law 25 guide
Self-assessment
Not asked
- Guidance
Use personal information only for the purposes it was collected for unless the person consents. That consent must be express for sensitive personal information.
Coverage
Explained in: Quebec Law 25 guide
Self-assessment
Not asked
- Guidance
Before collecting personal information with technology that can identify, locate or profile a person, inform them that the technology is used and how to activate those functions.
Coverage
Explained in: Cookie consent in Canada
Self-assessment
- Q6 — If your website uses cookies or tracking pixels, do non-essential trackers stay off until the visitor consents? (counts toward the Law 25 score)
- Not covered
If you offer the public a technological product or service with privacy settings, set those settings to the highest level of confidentiality by default.
Coverage
—
Self-assessment
Not asked
- Guidance
If you collect personal information by technological means, publish a confidentiality policy in clear and simple language on your website.
Coverage
Explained in: Writing a Canadian privacy policy
Self-assessment
- Q4 — Do you have a privacy policy published on your website? (counts toward the PIPEDA score)
- Guidance
Inform a person when a decision about them is based exclusively on automated processing of their personal information.
Coverage
Explained in: Law 25 vs. PIPEDA
Self-assessment
Not asked
- Planned
When sharing personal information with a service provider for a mandate or contract, put it in writing and specify the measures they must take to protect the information.
Coverage
Roadmap: AODA accessibility scanner & vendor tracking — Fall 2026
Explained in: Data processing agreements in Canada
Vendor tracking is not available today; this is explained in guidance only.
Self-assessment
- Q7 — Do the vendors that handle your customers' personal information have signed privacy commitments (DPAs), and is the sharing disclosed? (counts toward the PIPEDA score)
- Not covered
Give people access to their personal information and let them have it rectified. Reply in writing, promptly and no later than 30 days after receiving the request.
Coverage
The self-assessment asks whether you have an access and correction process, but we do not yet have dedicated Law 25 guidance or tooling for these requests.
Self-assessment
- Q11 — Do you have a process for customers to access, correct, or delete their personal information? (counts toward the PIPEDA score)
- Guidance
On request, communicate computerized personal information collected from the person in a structured, commonly used technological format, unless doing so raises serious practical difficulties.
Coverage
Explained in: Quebec Law 25 guide
Self-assessment
- Q12 — Do you have a process for customers to request their data in a portable format (CSV, JSON)? (counts toward the Law 25 score)
- Guidance
On request, stop disseminating personal information or de-index a hyperlink attached to a person’s name, where the dissemination contravenes the law or a court order.
Coverage
Explained in: Quebec Law 25 guide · Deletion and de-indexing rights
Self-assessment
Not asked
- Not covered
When the purposes for collecting or using personal information are achieved, destroy it or anonymize it, subject to any retention period required by law.
Coverage
—
Self-assessment
Not asked
| Obligation | Status | Coverage | Self-assessment | Source |
|---|---|---|---|---|
| The person with the highest authority in the enterprise is the person in charge of the protection of personal information unless the function is delegated in writing. Publish that person’s title and contact information on your website. | Guidance | Explained in: Quebec Law 25 guide · The Law 25 privacy officer The in-app PIPEDA & Law 25 knowledge centre includes a Privacy Officer starter kit (copyable templates, including a French contact block). |
| |
| Establish and implement governance policies and practices — covering how information is kept and destroyed, staff roles, and a complaints process — and publish detailed information about them in clear and simple language. | Not covered | — | Not asked | |
| Conduct a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. | Guidance | Explained in: Quebec Law 25 guide · Law 25 privacy impact assessments The in-app knowledge centre includes a six-step "PIA Lite" worksheet. It is a starting point, not a full assessment. |
| |
| Before communicating personal information outside Québec, conduct a privacy impact assessment, and put the communication under a written agreement. | Guidance | Explained in: Quebec Law 25 guide · Law 25 privacy impact assessments |
| |
| When you believe a confidentiality incident has occurred, take reasonable measures to reduce the risk of injury. If it presents a risk of serious injury, promptly notify the Commission d’accès à l’information and the persons concerned. | Guidance | Explained in: Quebec Law 25 guide The breach register can record whether the Commission was notified, but it does not send notifications. The in-app knowledge centre includes a breach response playbook. |
| |
| Keep a register of confidentiality incidents, and send a copy to the Commission on request. | Live | Feature: Breach register: logs each incident with dates, data involved, risk assessment, containment steps and whether the Commission was notified. The register was built around PIPEDA’s breach-record requirements. The Act allows a government regulation to set the register’s content; we have not mapped the register field by field against it. | Not asked | |
| Make sure consent is clear, free and informed, given for specific purposes, requested for each purpose in clear and simple language and — if requested in writing — presented separately from other information. | Guidance | Explained in: Quebec Law 25 guide | Not asked | |
| Use personal information only for the purposes it was collected for unless the person consents. That consent must be express for sensitive personal information. | Guidance | Explained in: Quebec Law 25 guide | Not asked | |
| Before collecting personal information with technology that can identify, locate or profile a person, inform them that the technology is used and how to activate those functions. | Guidance | Explained in: Cookie consent in Canada |
| |
| If you offer the public a technological product or service with privacy settings, set those settings to the highest level of confidentiality by default. | Not covered | — | Not asked | |
| If you collect personal information by technological means, publish a confidentiality policy in clear and simple language on your website. | Guidance | Explained in: Writing a Canadian privacy policy |
| |
| Inform a person when a decision about them is based exclusively on automated processing of their personal information. | Guidance | Explained in: Law 25 vs. PIPEDA | Not asked | |
| When sharing personal information with a service provider for a mandate or contract, put it in writing and specify the measures they must take to protect the information. | Planned | Roadmap: AODA accessibility scanner & vendor tracking — Fall 2026 Explained in: Data processing agreements in Canada Vendor tracking is not available today; this is explained in guidance only. |
| |
| Give people access to their personal information and let them have it rectified. Reply in writing, promptly and no later than 30 days after receiving the request. | Not covered | The self-assessment asks whether you have an access and correction process, but we do not yet have dedicated Law 25 guidance or tooling for these requests. |
| |
| On request, communicate computerized personal information collected from the person in a structured, commonly used technological format, unless doing so raises serious practical difficulties. | Guidance | Explained in: Quebec Law 25 guide |
| |
| On request, stop disseminating personal information or de-index a hyperlink attached to a person’s name, where the dissemination contravenes the law or a court order. | Guidance | Explained in: Quebec Law 25 guide · Deletion and de-indexing rights | Not asked | |
| When the purposes for collecting or using personal information are achieved, destroy it or anonymize it, subject to any retention period required by law. | Not covered | — | Not asked |
Guides to Quebec Law 25
Plain-language explainers on Quebec Law 25, each citing the statute or regulator guidance it draws on.
- What is Quebec Law 25? Requirements and Who It Applies ToWhat Quebec Law 25 requires, which businesses it covers, and the obligations now in force — the person in charge, consent, incidents and PIAs.
- Quebec Law 25 Penalties: Maximum Fines and How Penalties Are SetLaw 25 penalties explained: the monetary administrative penalties and penal fines in the Act, who can be held liable, and how exposure is assessed.
- Quebec Law 25 vs PIPEDA: Key Differences Canadian Businesses Must KnowLaw 25 vs PIPEDA: which law applies to your business, where Quebec goes further, and what to do when both apply to the same personal information.
- Privacy Impact Assessments in Canada: Law 25 PIA GuideWhen a privacy impact assessment is mandatory under Quebec Law 25, how to run one step by step, and a PIA template structure you can reuse.
- Quebec Law 25: Privacy Officer Requirements and ResponsibilitiesWhat Law 25 requires of a Quebec business's privacy officer: who qualifies, what you must publish on your website, the duties and small-business options.
- Law 25 French Language Requirements for Quebec BusinessesWhat Quebec's Charter of the French Language requires in French for privacy: policies, notices, cookie banners and how to structure a bilingual programme.
- Law 25 Compliance for Quebec SaaS Companies: Data Residency and Vendor ManagementQuebec Law 25 compliance guide for SaaS companies. Navigate data residency, PIAs, TRAs, and vendor requirements for software businesses.
- Quebec Law 25 for E-Commerce: What Online Retailers Must DoSelling online to Quebec customers? Law 25 imposes stricter consent, cookie, and privacy obligations than federal PIPEDA.