Law 25

What is Law 25 in Quebec?

Definition of Law 25

Law 25, formerly known as the Act to modernize legislative provisions as regards the protection of personal information, is a major reform of Quebec’s data privacy legislation. Adopted in September 2021, it notably amends the Act respecting the protection of personal information in the private sector and aims to strengthen transparency, accountability, and security for organizations handling personal data. This law applies to all Quebec businesses, including SMEs and companies in the construction sector, as soon as they collect, hold, or use personal information.

What are the objectives of Law 25?

Law 25 aims to:

• Enhance the protection of citizens’ personal information;
• Clarify the responsibilities of companies regarding data processing;
• Align Quebec laws with international standards such as the European Union’s General Data Protection Regulation (GDPR).

Main obligations for businesses

Increased accountability

Companies must now appoint a person responsible for the protection of personal information, usually the head of the organization or an officially designated delegate.

Incident log management

Every company must keep a record of privacy incidents (e.g., data breaches) and notify the Commission d’accès à l’information (CAI) and affected individuals if there is a serious risk of harm.

Explicit consent

Consent to collect data must be clear, free, informed, and specific. It must be obtained for each distinct purpose.

Transparency

Companies must inform individuals about the purposes of data collection, the methods used, and their right to access, correct, or withdraw consent.

Data portability

Individuals will soon have the right to request their personal data in a structured, commonly used technological format.

FAQ about Law 25

Who does Law 25 apply to?

It applies to all private companies operating in Quebec that collect, hold, or use personal information, regardless of their size or industry.

When did the various obligations come into effect?

The obligations came into effect progressively:

• 2022: designation of the responsible person and incident management.
• 2023: obligations on transparency, data minimization, and internal policies.
• 2024: right to data portability.

What are the consequences of non-compliance?

Penalties can reach up to $25 million or 4% of global revenue for the most serious cases. Administrative and criminal sanctions are also provided.

How to comply with Law 25?

To comply with Law 25, a company must appoint a person responsible for personal data protection, obtain informed consent, ensure data security, document incidents, and publish a transparent privacy policy.