Regulations › Rest of world › Quebec, Canada

Law 25

Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information)

In force privacy

WhenIn effect since 22 September 2022

Who enforces itCommission d'accès à l'information du Québec

Who it applies toOrganizations handling personal information of people in Quebec.

Tell the regulatorPromptly notify the Commission d'accès à l'information of incidents presenting a risk of serio… DPO requiredThe person with highest authority in every enterprise is by default the person in charge of pe… RegistrationNot addressed Transfers abroadBefore communicating data outside Quebec, conduct a PIA confirming adequate protection and sig… Request deadlineReply in writing promptly and within 30 days Maximum finePenal fines up to CAD 25 million or 4% of worldwide turnover

If you already comply with

81%

of Quebec's 21 requirements are already met by European Union (GDPR). Here is what Law 25 adds, biggest gaps first.

Lawful basisReach and lawful basisBig gap

GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.

Law 25 adds3 Consent is the default basis for use and communication, with listed exceptions. s.12, s.13, s.14 · source ↗

DPO requiredGovernanceBig gap

GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.

Law 25 adds3 The person with highest authority in every enterprise is by default the person in charge of personal information protection; may delegate in writing. s.3.1 · source ↗

DPIAGovernanceGap

GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.

Law 25 adds3 Privacy impact assessment required for any information system project involving personal information and before communicating data outside Quebec. s.3.3, s.17 · source ↗

RetentionGovernanceGap

GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.

Law 25 adds2 Destroy or anonymize information once its purposes are achieved, subject to legal retention periods. s.23 · source ↗

Already covered by GDPR: Reach abroad, Consent, Sensitive data, Children, Rights, Request deadline, Marketing, DPO qualifications, Registration, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Criminal liability, Private action.

A gap means Law 25 is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL