Quebec Law 25 Compliance: Complete Guide for Businesses
Quebec privacy law was rewritten by Law 25, originally Bill 64. This guide covers what it asks of businesses, which deadlines have already passed, and which parts of the work our tools help you track.
Final Phase Now in Effect
As of September 22, 2024, all provisions of Quebec's Law 25 are now in effect. Organizations doing business in Quebec must be fully compliant with Canada's strictest provincial privacy law—including data portability and the right to be forgotten.
Law 25 Implementation Timeline
Phase 1 - Complete
- • Designate Privacy Officer
- • Implement breach notification
- • Create privacy incident register
Phase 2 - Complete
- • Privacy policies published
- • Consent mechanisms updated
- • Privacy Impact Assessments
- • De-identification procedures
Phase 3 - NOW IN EFFECT
- • Data portability rights
- • Right to de-indexation
- • Right to be forgotten
- • Full compliance required
Key Law 25 Requirements
Law 25 significantly strengthens privacy rights in Quebec. Here are the main obligations.
Privacy Officer
Designate a person responsible for privacy compliance. Their contact info must be published on your website.
Privacy Impact Assessments
Conduct PIAs before implementing projects involving personal information or disclosing data outside Quebec.
Breach Notification
Notify the CAI and affected individuals of confidentiality incidents presenting "serious injury risk."
Enhanced Consent
Express consent required for sensitive info. Consent requests must be clear, simple, and separate from other info.
Data Portability
Individuals can request their data in a structured, commonly used format for transfer to another organization.
Right to Be Forgotten
Individuals can request de-indexation or cessation of dissemination of their personal information.
Law 25 Penalties
Administrative Penalties
Enforcement by CAI
Commission d'accès à l'information du Québec
The CAI has expanded powers under Law 25:
- Order organizations to comply
- Impose administrative monetary penalties
- Conduct investigations and audits
- Publish names of non-compliant organizations
How Canada Compliance AI helps with Quebec Law 25 today
Of the 17 Quebec Law 25 obligations on our coverage map, a product feature helps with 1, we explain 11, 1 is on the roadmap, and 4 are not covered.
Live product features
- Breach register: logs each incident with dates, data involved, risk assessment, containment steps and whether the Commission was notified.
On the roadmap
- AODA accessibility scanner & vendor tracking — Fall 2026
Further reading on Quebec Law 25
- What is Quebec Law 25? Requirements and Who It Applies To
- Quebec Law 25 vs PIPEDA: Key Differences Canadian Businesses Must Know
- Quebec Law 25: Privacy Officer Requirements and Responsibilities
- Privacy Impact Assessments in Canada: Law 25 PIA Guide
- Law 25 French Language Requirements for Quebec Businesses
- Quebec Law 25 Penalties: Maximum Fines and How Penalties Are Set
- Quebec Law 25 for E-Commerce: What Online Retailers Must Do
More in the compliance blog and the overview of Canadian regulations.