Quebec Law 25: what it requires, and a checklist to work from
Law 25 is now fully in force, with no minimum size or revenue threshold to trigger it — and it's stricter than PIPEDA in several specific ways. Here's what actually applies, and a practical checklist to work through.
Fully in force, and broader than most businesses expect
Formally the Act respecting the protection of personal information in the private sector, Law 25 (often called Loi 25) rolled out in three phases between September 2022 and September 2024 and is now completely in force. It applies to any organization — regardless of size, revenue, or industry — that carries on an enterprise in Quebec or handles the personal information of Quebec residents in the course of commercial activity. There's no minimum number of residents served and no revenue floor. Only spiritual and religious organizations get a narrow exclusion.
If your organization is already working through PIPEDA compliance, Law 25 isn't a separate project so much as a stricter overlay for anything touching Quebec residents. Where the two conflict, the higher standard governs.
What Law 25 actually requires
Five obligations do most of the work. Two of them are stricter than their PIPEDA equivalent.
A designated Privacy Officer
Mandatory, not optional. The designation must be in writing, publicly disclosed (typically on your website), and include a contact mechanism. The officer doesn’t need to be an employee — outsourced privacy-officer services are explicitly permitted.
Breach notification — a different threshold than PIPEDA
Law 25 uses a “risk of serious injury” test to trigger notification to the CAI and affected individuals — a differently worded standard than PIPEDA’s “real risk of significant harm.” Don’t assume a PIPEDA-calibrated breach process automatically satisfies this.
A 5-year incident register — every incident, not just reportable ones
You must maintain a register of every confidentiality incident, whether or not it met the notification threshold, retained for a minimum of five years and available for CAI inspection on request. This is longer than PIPEDA’s 24-month rule, and it’s the specific requirement most organizations quietly fall short on — they handle notification but not the underlying record-keeping.
Privacy Impact Assessments
PIAs are required before certain activities — notably before acquiring, developing, or overhauling an information system or electronic service delivery system involving personal information, and before transferring personal information outside Quebec.
AI and automated decision-making get specific rules
Sections 12.1 and 14 specifically govern AI-driven decisions about individuals. If an automated system makes a decision based solely on automated processing of someone’s personal information, you must proactively inform them of that fact, and provide manifestly informed, explicit consent mechanisms for the underlying data processing. This is one of the more current, less-understood parts of the law — worth a specific look if you use any automated scoring, eligibility, or recommendation systems touching Quebec residents.
Data portability
The final phase of the rollout, in effect since September 2024: individuals can request their personal data in a structured, commonly used, machine-readable format. If your systems weren’t built with export in mind, this is often the obligation that takes the most technical work to satisfy properly.
Quebec Law 25 compliance checklist
Six areas, worked through in order.
Governance
- Privacy Officer designated in writing, publicly disclosed with a working contact mechanism
- Privacy policies documented and actually reflect current practice
Consent & transparency
- Consent mechanisms meet the “manifestly informed and explicit” standard, not implied consent
- Any automated decision-making system discloses that fact to affected individuals
Breach readiness
- Breach assessment process specifically calibrated to the “risk of serious injury” test, not just reused from a PIPEDA process
- Incident register in place covering every incident, retained for 5 years, inspection-ready
Privacy Impact Assessments
- PIA process defined for new systems and electronic service changes involving personal information
- PIA triggered before any personal information transfer outside Quebec
Individual rights
- Working process to fulfill data portability requests in a structured, machine-readable format
- Access and correction request handling documented and actually usable
Not sure your incident register would survive a CAI inspection?
Let's walk through your current Law 25 posture and find the gaps before the CAI does.
Talk to Us About Law 25 Compliance