Law 25 (Quebec)
Also known as: Quebec Law 25 · Bill 64 · Quebec privacy law
Law 25 is the Quebec statute governing how businesses and public bodies collect, use and disclose personal information.
It applies to any organization collecting personal information in Quebec, whatever its size and wherever it is established. The test is not having an office in Montreal — it is processing the information of people who are there.
Its most structural requirements for a small organization are appointing a person responsible for the protection of personal information, maintaining an accessible privacy policy, reporting confidentiality incidents that present a serious risk, and assessing privacy factors before certain projects.
It also creates new rights for individuals, including portability of their information and the right to be told when a decision about them is made on a solely automated basis.
What it means for a small business
Many founders assume Law 25 targets large companies. It carries no employee threshold: a five-person business emailing Quebec customers is caught exactly as a bank is.
So what actually applies to you?
A definition tells you what a term means, not what your organization must do. The assessment answers the second question — free, no credit card.
Updated September 1, 2026 · Educational definition; not legal advice.