While these laws established foundational protections, they were implemented before the rise of digital platforms, big data, and AI-driven decision-making. The laws became outdated as technology advanced and data collection grew more complex.<\/p>\n\n\n\n
In response to these challenges, Qu\u00e9bec Law 25 was passed in 2021. It significantly amends, updates, and modernizes these existing laws. It also aligns Qu\u00e9bec\u2019s privacy framework with international standards, such as the European Union\u2019s General Data Protection Regulation (GDPR)<\/a>, and strengthens protections for individuals while holding organizations more accountable.<\/p>\n\n\n\n Qu\u00e9bec Law 25<\/a>, or \u201cAct to modernize legislative provisions as regards the protection of personal information,\u201d was introduced in the Qu\u00e9bec National Assembly in June 2020 as Bill 64. When the Bill was passed into law in September 2021, it became known as Law 25.<\/p>\n\n\n\n This new law gives individuals more control over their personal information and introduces stricter rules and stronger accountability for organizations that handle it.<\/p>\n\n\n\n Law 25 applies to any enterprise that collects, uses, or processes the personal information of individuals residing in Qu\u00e9bec, even if the enterprise itself is located outside the province. It is the most stringent provincial privacy regulation in Canada, and includes stipulations not reflected in the federal Personal Information Protection and Electronic Documents Act (PIPEDA)<\/a>, though that law, passed in 2000, has been amended a number of times.<\/p>\n\n\n\n The law uses the definition of enterprise outlined in Article 1525 of the Civil Code of Qu\u00e9bec<\/a>, which is \u201c[t]he carrying on by one or more persons of an organized economic activity, whether or not it is commercial in nature, consisting of producing, administering or alienating property, or providing a service, constitutes the operation of an enterprise.\u201d<\/em><\/p>\n\n\n\n This means that Law 25 applies to public bodies, private organizations, nonprofits, and even individuals acting in a professional capacity or carrying out an organized economic activity who collect the personal information of Qu\u00e9bec residents.<\/p>\n\n\n\n Personal information is defined similarly under both The Private Sector Act and The Public Sector Act as any information that relates to or concerns a natural person and directly or indirectly makes it possible to identify that person.<\/p>\n\n\n\n Personal information is considered sensitive if it is inherently private, such as medical or biometric data, or if the way it is used or shared creates a heightened expectation of privacy.<\/p>\n\n\n\n Qu\u00e9bec Law 25 does not cover personal information collected, stored, shared, or used for journalism, historical research, or genealogy that is used to provide legitimate information to the public.<\/p>\n\n\n\n Qu\u00e9bec Law 25 has introduced several new provisions that bring Qu\u00e9bec’s privacy regulation closer to global data protection regulations.<\/p>\n\n\n\n Qu\u00e9bec Law 25 outlines clear rules about how consent must be handled to give individuals control over their personal information. Personal information can only be used to serve the purpose for which it was collected unless the individual gives explicit consent for a different purpose.<\/p>\n\n\n\n However, there are a few exceptions. Personal information can be used for another purpose without new consent, but only:<\/p>\n\n\n\n Consent must always be clear, freely given, informed, and specific. Enterprises must request consent using simple and unambiguous language, and must make a separate request for each purpose. If enterprises request consent in writing, it should be separate from other information given to the individual, such as terms and conditions.<\/p>\n\n\n\n When it comes to sensitive personal information, consent must always be explicit.<\/p>\n\n\n\n Individuals also have the right to withdraw their consent at any time, and the enterprise must stop using the individual\u2019s personal information once consent is withdrawn.<\/p>\n\n\n\n For personal information belonging to minors under 14 years old, a parent, guardian, or tutor must give consent. Minors aged 14 or older can give their own consent or allow their parent, guardian, or tutor to provide it.<\/p>\n\n\n\n Qu\u00e9bec Law 25 has strengthened individuals\u2019 rights relating to their personal information.<\/p>\n\n\n\n Right to transparency in automated decision-making<\/strong>: Enterprises must disclose when automated systems make decisions that affect individuals.<\/p>\n\n\n\n Qu\u00e9bec Law 25 requires enterprises to conduct a privacy impact assessment (PIA) or data protection impact assessment (DPIA)<\/a> in certain situations, including:<\/p>\n\n\n\n When an enterprise suspects there has been a data breach involving personal information \u2014 known under the law as a confidentiality incident \u2014 it must take reasonable measures to reduce the risk of injury and prevent similar incidents in the future.<\/p>\n\n\n\n The following are considered confidentiality incidents under the law:<\/p>\n\n\n\n Qu\u00e9bec Law 25 also requires that, if the breach presents a “risk of serious injury\u201d an enterprise must inform Qu\u00e9bec’s privacy regulator, known as the Commission d\u2019acc\u00e8s \u00e0 l\u2019information du Qu\u00e9bec (CAI), and affected individuals about the breach. An exception may be made if notifying individuals would interfere with a legal investigation.<\/p>\n\n\n\n Enterprises must maintain a register of data breaches and make it available to the Commission upon request.<\/p>\n\n\n\n Qu\u00e9bec Law 25 requires enterprises that must comply with the law to publish a privacy policy<\/a> explaining their data practices. Privacy policies must be written in simple language that is easy for individuals to understand.<\/p>\n\n\n\n The privacy policy should include:<\/p>\n\n\n\n Qu\u00e9bec Law 25 automatically appoints the \u201cperson exercising the highest authority\u201d <\/em>in an enterprise as the person in charge of protecting personal information. This role is similar to that of a Data Protection Officer (DPO) under the GDPR. An enterprise does have the option to appoint another individual as DPO and can assign some or all of the statutory responsibilities in writing.<\/p>\n\n\n\n A private organization may appoint any person as DPO or privacy officer, regardless of whether they are an employee. In the case of public bodies, the appointed DPO may be one of the following: <\/p>\n\n\n\n Public bodies are also required to inform the Commission in writing about the title, contact information, and start date of the appointed DPO.<\/p>\n\n\n\n Enterprises must publish the title and contact information of the DPO on their website. If the enterprise doesn\u2019t have a website, it must make this information available by \u201cany other appropriate means.\u201d<\/em><\/p>\n\n\n\n The Qu\u00e9bec privacy law was implemented in stages to give enterprises time to comply with its requirements:<\/p>\n\n\n\n With all provisions of Qu\u00e9bec Law 25 now fully operational, enterprises must align their privacy practices with the law to avoid penalties and maintain trust with Qu\u00e9bec residents.<\/p>\n\n\n\n Qu\u00e9bec Law 25 is enforced by the Commission d\u2019acc\u00e8s \u00e0 l\u2019information du Qu\u00e9bec (CAI), which has the authority to monitor compliance, conduct investigations, and impose penalties for violations.<\/p>\n\n\n\n Noncompliance can lead to substantial financial penalties:<\/p>\n\n\n\n Additionally, individuals who believe their privacy rights have been violated can seek damages of at least CAD 1,000 and may also pursue collective action against violators.<\/p>\n\n\n\n Beyond financial penalties, noncompliance can lead to reputational damage, which can erode customer trust and harm long-term business relationships.<\/p>\n\n\n\n To meet the requirements of Qu\u00e9bec Law 25, organizations must take proactive measures to responsibly manage personal information and protect individual privacy.<\/p>\n\n\n\n We strongly recommend consulting a qualified legal expert who can give advice for achieving compliance with Qu\u00e9bec Law 25 that is specific to your enterprise’s data privacy practices.<\/p>\n\n\n\nWhat is Qu\u00e9bec Law 25 and who does it apply to?<\/strong><\/h2>\n\n\n\n
What is personal information under Qu\u00e9bec Law 25?<\/strong><\/h2>\n\n\n\n
Key provisions under Qu\u00e9bec Law 25<\/strong><\/h2>\n\n\n\n
Enhanced consent requirements<\/strong><\/h3>\n\n\n\n
\n
New and expanded individual rights<\/strong><\/h3>\n\n\n\n
\n
![\"\"](\"https:\/\/usercentrics.com\/wp-content\/uploads\/sites\/7\/2025\/01\/uc_770x775_quebec_law_122024_2.svg\")
<\/figure>\n\n\n\nPrivacy impact assessments<\/strong><\/h3>\n\n\n\n
\n
Data breach notification<\/strong><\/h3>\n\n\n\n
\n
Privacy policy requirements<\/strong><\/h3>\n\n\n\n
\n
Appointment of a privacy officer<\/strong><\/h3>\n\n\n\n
\n
When did Qu\u00e9bec Law 25 come into effect?<\/strong><\/h2>\n\n\n\n
\n
Qu\u00e9bec Law 25 enforcement and penalties<\/strong><\/h2>\n\n\n\n
\n
Steps for compliance with Qu\u00e9bec Law 25<\/strong><\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/usercentrics.com\/wp-content\/uploads\/sites\/7\/2025\/01\/uc_770x775_quesbec_law_checklist_123024.svg\")
<\/figure>\n\n\n\nQu\u00e9bec Law 25 compliance with Usercentrics<\/strong><\/h2>\n\n\n\n
![\"\"](\"https:\/\/usercentrics.com\/wp-content\/uploads\/sites\/7\/2025\/01\/uc_blog_770x500_quebec_vs_pipeda_123024_3.svg\")
<\/figure>\n\n\n\n