Quebec Law 25

No changes recorded yet — we are watching, and nothing has been published.

1. 2024-09-22 Law 25 data portability right takes effect
2. 2023-09-22 Most Law 25 provisions take effect, including consent, transparency and administrative monetary penalties of up to $10 million or 2% of worldwide turnover
3. 2022-09-22 First Law 25 provisions take effect (person in charge, confidentiality incidents, biometrics disclosure)

1. 2024-09-22
   Law 25, final stage (data portability) Amendment

   The right to receive computerised personal information in a structured, commonly used technological format took effect, completing Law 25's three-year rollout. source

2. 2023-09-22
   Law 25, second stage Amendment

   Most of Law 25 took effect, including new consent and transparency rules, privacy impact assessments before communicating information outside Quebec, and administrative monetary penalties. source

3. 2022-09-22
   Law 25, first stage Amendment

   First provisions took effect: a person in charge of personal information, confidentiality incident reporting and register, prior disclosure of biometric identity checks, and rules for communication in commercial transactions and research. source

4. 2021-09-22
   Law 25 (S.Q. 2021, c. 25) assented to Major version

   Act to modernize legislative provisions as regards the protection of personal information (Bill 64), passed on 21 September 2021, assented to on 22 September 2021 and phased in over three years. source

The Act covers personal information handled by any enterprise in Quebec, in any medium, with an exception for journalistic, historical or genealogical material.

Enterprises

Personal information that a person collects, holds, uses or communicates in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code (section 1). source

Any medium

It applies whether the enterprise keeps the information itself or through a third person, and whatever its medium or form (section 1). source

Excluded

Journalistic, historical or genealogical material collected, held, used or communicated for the legitimate information of the public (section 1). source

Outside Quebec

Before communicating personal information outside Quebec, the enterprise must conduct a privacy impact assessment (section 17). source

Enterprises name a person in charge, assess privacy impacts of new systems and transfers, and report serious confidentiality incidents to the CAI.

Person in charge

The person with the highest authority is in charge of protecting personal information, may delegate in writing, and the title and contact details must be published on the website (section 3.1). source

Privacy impact assessment

Required for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information (section 3.3). source

Confidentiality incidents

Promptly notify the CAI and affected persons of an incident presenting a risk of serious injury (section 3.5), and keep a register of all incidents (section 3.8). source

Portability

On request, communicate computerised personal information collected from the person in a structured, commonly used technological format (section 27). source

The CAI can impose administrative monetary penalties and bring penal proceedings, and courts award punitive damages for intentional or grossly negligent infringements.

Penalty power

Since 22 September 2023 the CAI can impose administrative monetary penalties on enterprises, under a published general framework. source

Undertakings

A person in default may enter into an undertaking with the CAI to remedy the failure; if accepted and complied with, no penalty is imposed for those acts (section 90.1). source

Punitive damages

Where an unlawful infringement causes injury and is intentional or results from gross fault, the court awards punitive damages of at least $1,000 (section 93.1). source

1. Law text Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
2. Law text An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25, as assented)
3. Guidance Principaux changements apportés par la Loi 25 (CAI)
4. Guidance Sanctions administratives pécuniaires - general framework (CAI)

1. PIPEDA

   The federal private-sector privacy law, whose maximum penalties are court fines of up to $100,000 for specific offences.

2. GDPR

   The EU regulation, enforced by data protection authorities with two tiers of fines based on worldwide turnover.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Quebec Law 25 (RSS)