Regulations › Rest of world › Quebec, Canada
Law 25
Quebec Law 25 (Act to modernize legislative provisions as regards the protection of personal information)
WhenIn effect since 22 September 2022
Who enforces itCommission d'accès à l'information du Québec
Who it applies toOrganizations handling personal information of people in Quebec.
Tell the regulatorPromptly notify the Commission d'accès à l'information of incidents presenting a risk of serio…
DPO requiredThe person with highest authority in every enterprise is by default the person in charge of pe…
RegistrationNot addressed
Transfers abroadBefore communicating data outside Quebec, conduct a PIA confirming adequate protection and sig…
Request deadlineReply in writing promptly and within 30 days
Maximum finePenal fines up to CAD 25 million or 4% of worldwide turnover
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to enterprises collecting, holding, using or communicating personal information about people in Quebec in the course of business.s.1 · source ↗
Extraterritorial reach not stated expressly; Commission and commentators apply it to out-of-province businesses serving Quebecers.
Lawful basis
3
Consent is the default basis for use and communication, with listed exceptions.s.12, s.13, s.14 · source ↗
Consent
2
Consent must be manifest, free, enlightened, given for specific purposes, requested separately, and valid only as long as needed.s.14 · source ↗
Sensitive data
1
Sensitive information requires express consent for secondary uses and communication.s.12 · source ↗
Biometric databases must be disclosed to the Commission under the IT Act (CQLR c C-1.1 s.45); not verified.
Children
2
Information about a minor under 14 requires consent from the person with parental authority, unless clearly for the minor's benefit.s.4.1 · source ↗
People's rights
Rights
3
Access, rectification, portability, de-indexing or cessation of dissemination, consent withdrawal, and information on automated decisions.s.27, s.28, s.28.1, s.12.1 · source ↗
Request deadline
2
Reply in writing promptly and within 30 days; no reply is a deemed refusal.s.32 · source ↗
Marketing
1
Prospection must identify the enterprise and inform individuals of their right to withdraw consent; electronic messages need CASL opt-in.s.22 · source ↗
CASL is federal and separate.
Governance
DPO required
3
The person with highest authority in every enterprise is by default the person in charge of personal information protection; may delegate in writing.s.3.1 · source ↗
DPO qualifications
–
Not addressedN/A · source ↗
Title and contact details must be published on the enterprise website (s.3.1); not separately verified.
DPIA
3
Privacy impact assessment required for any information system project involving personal information and before communicating data outside Quebec.s.3.3, s.17 · source ↗
Records
1
No processing inventory; enterprises must keep a register of confidentiality incidents.s.3.8 · source ↗
Retention
2
Destroy or anonymize information once its purposes are achieved, subject to legal retention periods.s.23 · source ↗
Breaches
Tell the regulator
1
Promptly notify the Commission d'accès à l'information of incidents presenting a risk of serious injury.s.3.5 · source ↗
Tell people
2
Promptly notify affected persons of incidents presenting a risk of serious injury.s.3.5 · source ↗
Transfers
Transfers abroad
2
Before communicating data outside Quebec, conduct a PIA confirming adequate protection and sign a written agreement.s.17 · source ↗
Mandatory PIA plus written contract; no adequacy list.
Enforcement
Maximum fine
3
Penal fines up to CAD 25 million or 4% of worldwide turnover; administrative penalties up to CAD 10 million or 2%.s.91, s.90.12 · source ↗
Criminal liability
1
Penal offenses with fines for enterprises and individuals (CAD 5,000-100,000); directors or officers who authorize offenses can be party to them.s.91, s.93 · source ↗
Officer liability (s.93) not verified this session. Fines only.
Private action
3
Courts must award punitive damages of at least CAD 1,000 for intentional or grossly negligent infringements; class actions available.s.93.1 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws