Law 25 — Free Compliance Assessment
Assess your compliance with Quebec's Law 25 for free with a CISO-level questionnaire.
In force
Since September 2024
Regulator
CAI (Québec)
Penalties
$25M or 4% revenue
What is Law 25?
Law 25, or the Act to modernize legislative provisions respecting the protection of personal information, is Quebec's major personal data protection reform. Phased in since 2022, it has been fully applicable since September 2024.
It applies to any organization that collects, uses or discloses personal information in Quebec, whether public or private, small or large.
Main obligations
- →Appoint a personal information protection officer
- →Publish a clear and accessible privacy policy
- →Conduct privacy impact assessments (PIAs)
- →Notify the CAI within 72 hours in case of incident
- →Obtain valid and explicit consent
- →Ensure transparency in automated decisions
Frequently asked questions about Law 25
Who does Law 25 apply to?+
Any private enterprise that collects, holds, uses or communicates personal information in Quebec, regardless of size — including businesses outside Quebec that process data of Quebec residents.
What are the penalties under Law 25?+
Administrative monetary penalties up to CAD $10 million or 2% of worldwide turnover, and penal fines up to CAD $25 million or 4% of worldwide turnover, whichever is greater.
Is a privacy officer mandatory?+
Yes, since September 2022. By default it is the person with the highest authority (CEO), who may delegate the role in writing. Their contact details must be published on the company's website.
What must be done after a confidentiality incident?+
If the incident presents a risk of serious injury, the company must promptly notify the Commission d'accès à l'information (CAI) and the affected individuals, and keep a register of all confidentiality incidents.
What is a PIA (EFVP) and when is it required?+
A privacy impact assessment is mandatory before any project to acquire, develop or overhaul a system involving personal information, and before communicating personal information outside Quebec.