Quebec Law 25: Complete Compliance Guide (2026)

By Daniel de Almeida Afonso · Last updated: October 7, 2026

Quebec's Law 25 is fully in force, and it applies to any business that handles the personal information of people in Quebec, wherever the business is based. Law 25 is the common name for the Act to modernize legislative provisions as regards the protection of personal information, which was introduced as Bill 64 and passed in September 2021. It amended the province's private-sector privacy statute, the Act respecting the protection of personal information in the private sector (the "Private Sector Act").

The last phase, data portability, took effect on September 22, 2024. As of January 2026, the Commission d'accès à l'information (CAI) had not yet imposed a single monetary penalty. That is not a reason to wait. Individuals can already sue, and the CAI is receiving hundreds of incident notices a year.

This guide explains who is covered, what the law requires, how it is enforced, and what to do first.

When did Law 25 come into effect?

Law 25 came into effect in three phases, each starting on September 22. All three have now passed.

September 22, 2022. Organizations had to designate a privacy officer and publish their contact details. They also had to report serious confidentiality incidents to the CAI and to the people affected, and keep a register of every incident. The first rules on sharing information without consent, for commercial transactions and for research, started here as well.
September 22, 2023. Most of the law took effect. This phase covers governance policies, transparency, the stricter consent standard, privacy impact assessments, rules for transfers outside Quebec, written agreements with service providers, notices about automated decisions, and the de-indexation right. It also covers rules on technologies that identify, locate, or profile people, and privacy settings that default to the highest level of confidentiality.
September 22, 2024. The right to data portability began. People can ask for their computerized personal information in a structured, commonly used technological format. They can also ask that it be sent to another organization.

If you are reading older guides that say a deadline is "coming soon," they are out of date. Every deadline has passed.

Who does Law 25 apply to?

The Private Sector Act applies to anyone who collects, holds, uses, or communicates personal information while carrying on an enterprise in Quebec. A parallel regime covers public bodies. The practical result is broad.

Businesses of any size. A local shop, an online store, and a multinational all have the same core obligations.
Professionals. Doctors, lawyers, accountants, and real estate agents are covered when they run an enterprise.
Non-profits and associations. Being non-profit does not create an exemption.
Organizations outside Quebec. There is no revenue or headcount threshold. If you handle personal information about people in Quebec as part of your business, assume the law applies to you.

What counts as personal information?

Personal information is any information about a natural person that allows that person to be identified. Information about a company is not personal information.

The law gives extra weight to sensitive personal information. This is information that, by its nature or the context of its use, carries a high reasonable expectation of privacy. Health data and biometric data are typical examples. Sensitive information generally requires express consent.

What does Law 25 require?

Law 25 is closer to the GDPR than to most North American privacy laws. The sections below cover the obligations that most often cause trouble.

Governance and the privacy officer

Every organization is responsible for the personal information it holds. By default, the person with the highest authority, such as the CEO, acts as the privacy officer. That person may delegate the role in writing to an employee or to an outside party.

The organization must publish the privacy officer's title and contact details on its website. The CEO stays ultimately accountable even after delegating.

This means the role is not optional in the way some older guides claim. You can choose who holds it, but someone always does.

Organizations must also adopt and publish governance policies. These policies cover how personal information is handled across its lifecycle, who does what, and how complaints are received and answered.

Consent must be manifest, free, informed, and given for specific purposes. You must ask for it separately for each purpose, in simple and clear language. A written request for consent must be presented separately from other information.

Quebec treats transparency as the baseline. At the time of collection, you must tell people:

The purposes of the collection.
The means by which you collect the information.
Their rights of access and rectification.
Their right to withdraw consent.
Whether the information may be communicated outside Quebec.

Consent from a minor under 14 comes from the holder of parental authority or the tutor. A minor 14 or older can consent personally.

Cookies, tracking, and the "off by default" rule

Section 8.1 of the Act covers any technology that can identify, locate, or profile a person. You must tell people about the technology and how to activate those functions. The CAI's guidance reads this as a requirement that these functions be off until the person turns them on.

For websites, this has a clear consequence. Cookies and similar tools used for profiling or targeted advertising should not fire before the visitor opts in. That makes the model closer to GDPR cookie consent than to the opt-out approach used in most US states. Pre-ticked boxes and "continue browsing means you accept" notices do not meet the standard.

Do not confuse this with the separate "confidentiality by default" rule. Under that rule, a technological product or service offered to the public must ship with privacy settings at the highest level of confidentiality, with no action from the user. The Act expressly exempts browser cookies from that rule. Cookies are still caught by section 8.1 and by the consent rules whenever they profile or track.

For a deeper look at the federal side of cookie consent, see our guide to PIPEDA cookie banner requirements.

Privacy impact assessments

You must carry out a privacy impact assessment (PIA) in three situations:

Before you acquire, develop, or redesign an information system or electronic service delivery project that involves personal information.
Before you communicate personal information outside Quebec.
Before you share information without consent for study, research, or statistics under an agreement.

The assessment must be proportionate to the sensitivity of the information, the purpose, the volume, and how it is stored. The duty is not retroactive. Existing systems do not need a PIA until you make a substantial update, which counts as a redesign.

The CAI publishes a PIA guide, updated in April 2024. If you run many projects, a structured process for automating privacy impact assessments keeps this manageable.

Service providers and transfers outside Quebec

When a service provider handles personal information for you, you need a written agreement. The agreement must set out the security measures the provider will apply, limit use to the agreed purpose, and require the provider to notify your privacy officer of any breach or attempted breach.

Transfers outside Quebec have their own test. Before the transfer, you must run a PIA that weighs four factors:

The sensitivity of the information.
The purposes of the transfer.
The safeguards, including contractual safeguards.
The legal regime in the destination, including its privacy principles.

The transfer can go ahead only if the PIA shows the information would be adequately protected, with regard to generally accepted privacy principles. The Act does not require data to stay in Quebec. It requires you to prove the destination is safe enough.

Individual rights

People have these rights under the Private Sector Act:

Access to their personal information.
Rectification of inaccurate, incomplete, or equivocal information.
Withdrawal of consent to use or communication.
Portability, in a structured and commonly used technological format.
De-indexation, which means asking you to stop disseminating their information or to de-index a link, in the cases the law lists.
Notice and a chance to respond when a decision is based exclusively on automated processing. People can ask what information and factors were used, and they can submit observations to someone able to review the decision.

You must also destroy or anonymize personal information once the purposes for collecting it are achieved, subject to retention laws. This is a destruction duty, not a general "right to be forgotten" in the GDPR sense.

Security and confidentiality incidents

You must apply security measures that fit the sensitivity of the information. A confidentiality incident is any unauthorized access, use, or disclosure, or the loss of personal information.

If an incident presents a risk of serious injury, you must notify the CAI and the affected people promptly. You must also keep a register of all incidents, including ones that do not trigger a notice, and give it to the CAI on request.

How is Law 25 enforced?

Three mechanisms work side by side.

Administrative monetary penalties. A person designated by the CAI can impose penalties of up to CAD 50,000 for an individual. For any other party, the cap is CAD 10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Before imposing one, the CAI sends a notice of non-compliance. You can also give the CAI a written undertaking to fix the problem, which can prevent a penalty.

Penal fines. For an enterprise, fines run from CAD 15,000 up to CAD 25 million or 4% of worldwide turnover, whichever is greater. For an individual, the range is CAD 5,000 to CAD 100,000. Fines double for a repeat offence. The Court of Quebec imposes them after the CAI starts proceedings.

Private right of action. A person who suffers injury from a violation can sue. The court can award punitive damages of at least CAD 1,000 when the violation is intentional or results from gross fault.

These figures come from the CAI's own description of its sanctions regime. Read the CAI's page on sanctions and the Act itself on Légis Québec before you rely on them.

What enforcement has looked like so far

In a letter dated January 9, 2026, the CAI stated that it had received 518 confidentiality incident notices between January 1 and December 10, 2025. The same letter said the CAI had imposed no administrative monetary penalty and no penalty of any kind to that date.

The CAI has still been active. It took part in a 2025 joint investigation of TikTok with other Canadian privacy regulators. It has also issued guidance on consent and on privacy impact assessments, and it published a framework that sets out how it decides when to impose penalties.

Private litigation is growing faster than regulatory fines. Plaintiffs have filed claims seeking punitive damages in cases such as Synotte v. TikTok Technology Canada and S.C. v. Gameloft (both 2025). We have not verified how these cases ended, so treat them as signals of risk rather than precedent.

We also found no verified amendment to the Private Sector Act's penalty amounts or transfer rules in 2025 or 2026. Some third-party blogs claim penalties were raised in 2026. We could not match those claims to any bill or statute, so we have not included them. Check Légis Québec for the current consolidated text before you rely on any figure.

How does Law 25 compare to PIPEDA?

PIPEDA is Canada's federal private-sector law. It covers commercial activity across the country. Law 25 is stricter on several points. For background on the federal law, see our overview of what PIPEDA is and who enforces it.

Area	Law 25 (Quebec)	PIPEDA (federal)
Consent	Manifest, free, informed, and specific to each purpose	Implied consent allowed in some cases
Profiling and tracking tech	Must be off until the person activates it	No equivalent rule
Monetary penalties	AMPs up to CAD 10M or 2%; fines up to CAD 25M or 4%	No direct fining power for the regulator
Private lawsuits	Punitive damages of at least CAD 1,000	Complaint to the regulator first, then Federal Court

In practice, you need to meet both. Quebec's rules are the higher bar for people in Quebec. If you already meet the GDPR, you have a head start, because the consent, impact assessment, and transfer rules look familiar. Our PIPEDA vs GDPR comparison shows where the Canadian and European approaches line up.

How should you prepare?

Work through these steps in order.

Map your data. List what personal information you collect, where it lives, and who receives it.
Name your privacy officer. Confirm who holds the role, delegate in writing if needed, and publish the contact details.
Audit your website tracking. Find every cookie and tag that identifies, locates, or profiles visitors. Make sure none fire before opt-in.
Rewrite your privacy policy. Use clear language. Cover purposes, means of collection, rights, and possible transfers outside Quebec.
Run PIAs where required. Start with new systems and any transfer of data outside Quebec.
Review your contracts. Make sure every service provider agreement is in writing and covers security, purpose limits, and breach notice.
Set up incident handling. Build a response plan, a risk assessment step, and the register.
Test your rights workflows. Confirm you can handle access, rectification, portability, and de-indexation requests on time.
Train your staff. Everyone who touches personal data should know the basics and who to call.

Secure Privacy offers a free PIPEDA compliance checklist if you want a starting point for the federal side.

FAQ

Does Law 25 apply to companies outside Quebec?

Yes, if you handle personal information about people in Quebec as part of your business. The law follows the individual, not your office address. There is no minimum number of Quebec customers.

Is a privacy officer mandatory under Law 25?

The role is mandatory, but the person is flexible. By default the highest-ranking person in the organization holds it. You can delegate it in writing to someone else, inside or outside the organization, and you must publish their title and contact details.

If your site uses cookies or similar tools that profile or track visitors, yes. Those tools should be off until the visitor opts in. Whatever cookies you use, describe them in your privacy notice. Ask a Quebec privacy lawyer which of your cookies, if any, can safely run before consent.

What are the penalties for violating Law 25?

Administrative monetary penalties reach CAD 10 million or 2% of worldwide turnover. Penal fines reach CAD 25 million or 4%. Individuals can also seek punitive damages of at least CAD 1,000 for intentional or grossly negligent violations.

Has anyone been fined under Law 25?

Not as of the CAI's January 9, 2026 letter, which reported no monetary penalties imposed. We did not find a later penalty in the sources we checked. Court claims by individuals are rising.

Can I transfer data outside Quebec?

Yes, after a privacy impact assessment shows the information would be adequately protected, and with a written agreement in place. You must also tell people at collection that their information may leave Quebec.

At 14. For a child under 14, consent comes from a parent, guardian, or tutor.