Quebec Law 25 is the 2021 law that modernized Quebec’s privacy rules, requiring businesses that handle personal information to name a person in charge of privacy, report serious confidentiality incidents, assess privacy risks and face fines of up to $25 million CAD or 4% of worldwide turnover.
You run a business. Some of your clients live in Quebec. Maybe you have an office in Montréal, or you simply collect names, emails and documents through your website.
Either way, you have probably heard that Quebec has the strictest privacy law in Canada. This guide explains what Law 25 requires in plain language, when each part took effect, how it differs from the federal law, and the everyday habits, like how you send files, that keep you on the right side of it.
Quick Summary
- Quebec Law 25 (formerly Bill 64) was adopted in September 2021 and took effect in three phases: September 22 of 2022, 2023 and 2024.
- Every business must have a person in charge of the protection of personal information, by default the person with the highest authority, and publish that title and contact information.
- Confidentiality incidents that present a risk of serious injury must be reported to the Commission d’accès à l’information and to the people affected. All incidents go in a register.
- Privacy impact assessments are required for new information systems and before personal information is sent outside Quebec.
- Administrative penalties can reach $10 million CAD or 2% of worldwide turnover; penal fines can reach $25 million CAD or 4%.
In This Guide
What Is Quebec Law 25?
Quebec Law 25 is the common name for An Act to modernize legislative provisions as regards the protection of personal information, adopted by Quebec’s National Assembly in September 2021. It rewrote Quebec’s private-sector and public-sector privacy laws to give people more control over their personal information and to give the regulator real enforcement power.
Before it was passed, it was known as Bill 64, which is why you will still see both names. Law 25 does not replace Quebec’s private-sector privacy act; it amends it. The Act respecting the protection of personal information in the private sector (often called the “private sector act”) is still the law businesses follow, now with Law 25’s new obligations built in.
The regulator is the Commission d’accès à l’information du Québec (CAI). According to the CAI’s overview of the main changes, the reform touches governance, consent, transparency, confidentiality incidents, citizens’ rights and sanctions. When the main phase took effect, the Quebec government described the changes as “the most ambitious of their kind in Canada to date” (our translation).
Who Does Law 25 Apply To?
Law 25 applies to every business that collects, holds, uses or shares personal information about people in Quebec, whatever its size. A two-person accounting practice is covered in the same way as a large retailer. Public bodies, such as ministries and municipalities, have parallel obligations under Quebec’s public-sector access act.
Personal information means any information about a person that allows them to be identified, directly or indirectly: a name with an address, a social insurance number, a scanned ID, a medical note, a payroll file. The CAI treats information as sensitive when, because of its medical, biometric or otherwise intimate nature, or the context in which it is used, it raises “a high reasonable expectation of privacy.”
Businesses outside Quebec are not automatically exempt. If you collect personal information from people in Quebec in the course of your business, plan on meeting Law 25 as well as the federal rules.
When Did Law 25 Take Effect?
Law 25 took effect in three phases. The first obligations started on September 22, 2022, most of the law took effect on September 22, 2023, and the right to data portability followed on September 22, 2024. Every part of the law that applies to businesses is now in force.
The CAI’s announcement of September 22, 2022 listed the first obligations for businesses, and the Quebec government confirmed on September 22, 2023 that “the majority” of the law’s provisions took effect that day.
| Date | What took effect for businesses |
|---|---|
| September 22, 2022 | Person in charge of personal information named and published; confidentiality incident register; reporting serious incidents to the CAI and the people affected; disclosing biometric identity checks to the CAI in advance; new rules for sharing information without consent in a business transaction or for research |
| September 22, 2023 | Governance policies; privacy policy for information collected by technological means; privacy impact assessments; stricter consent; transparency at collection; privacy by default; rules for sending information outside Quebec; right to de-indexing; administrative penalties and higher penal fines |
| September 22, 2024 | Right to data portability: on request, give a person the computerized personal information collected from them in a structured, commonly used format |
What Does Law 25 Require From Businesses?
Law 25 requires businesses to make one person accountable for privacy, publish clear policies, assess privacy risks before new projects and cross-border transfers, ask for consent purpose by purpose, protect information with reasonable security measures, and record and report confidentiality incidents. Here are the main obligations.
1. Name a Person in Charge of Personal Information
The CAI says the person with the highest authority in the business, usually the owner or CEO, is the person in charge of the protection of personal information by default. That person can delegate the role in writing, in whole or in part. The title and contact information of the person in charge must be published on the business’s website, or made available by another appropriate means if there is no website.
2. Adopt Governance Policies and a Privacy Policy
Businesses must set and apply policies covering, at least, how long personal information is kept and when it is destroyed, the roles and responsibilities of staff throughout the information’s life cycle, and how privacy complaints are handled. Detailed information about these policies must be published on the website. If you collect personal information through technological means, such as a website form, you also need a privacy policy written “in clear and simple terms” and must tell people when it changes.
3. Run Privacy Impact Assessments
A privacy impact assessment (in French, évaluation des facteurs relatifs à la vie privée) is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before personal information is communicated outside Quebec. The CAI says the assessment must be proportionate to the sensitivity of the information, the purpose of its use, its quantity, its distribution and its medium.
Information may be sent outside Quebec only if the assessment shows it would receive adequate protection, and the transfer must be covered by a written agreement. In practice, that includes cloud software and service providers that store data elsewhere, so ask every provider where your data is kept.
4. Get Clear Consent for Each Purpose
Consent must be manifest, free, informed and given for specific purposes. It must be requested for each purpose in clear and simple terms, and a written request must be presented separately from any other information. Using sensitive information for a new purpose requires express consent. The Quebec government also notes that consent for a person under 14 must come from the parent or tutor.
5. Be Transparent and Private by Default
When you collect personal information, you must tell people the purposes and means of collection, their rights of access and correction, their right to withdraw consent, and whether the information may be communicated outside Quebec. Technology products and services offered to the public must use the highest level of confidentiality by default, without the person having to change anything. Features that identify, locate or profile a person must be off unless the person turns them on.
6. Respect New Individual Rights
People can ask a business to stop disseminating their personal information or to de-index a hyperlink attached to their name when that causes them harm or breaks the law. If a decision about them is based exclusively on automated processing, they must be told no later than when they are informed of the decision, and they can ask a staff member to review it. Since September 22, 2024, they can also ask for their computerized information in a portable format.
Many of these duties have close equivalents in federal law. For the federal side, see our plain-language guide to PIPEDA.
What Counts as a Confidentiality Incident Under Law 25?
Under Law 25, a confidentiality incident is any access to, use or communication of personal information that the law does not authorize, or the loss of personal information or any other breach of its protection. The CAI gives a staff member sending personal information to the wrong recipient as a typical example.
The CAI’s guidance for businesses lists three common examples: an employee consulting personal information without authorization, an employee communicating personal information to the wrong recipient, and a cyberattack such as phishing or ransomware. When an incident happens, the business must:
- Act quickly to reduce the risk of injury to the people concerned and to prevent a similar incident.
- Assess the risk of serious injury, considering the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be misused, and consult the person in charge of personal information.
- Notify the CAI promptly, in writing, and notify every person affected, when there is a risk of serious injury. The CAI publishes a notice form for this.
- Record every incident in a register, including those with no risk of serious injury, and send a copy to the CAI on request. The CAI says register entries must be kept for at least five years after the business became aware of the incident.
Notice to an affected person must describe the information involved, the circumstances and date of the incident, what the business has done to reduce the risk, what the person can do to protect themselves, and who to contact for more information.
Notice that the most common example has nothing to do with hackers. A file attached to the wrong email, an auto-completed address, a shared folder link forwarded too widely: these are everyday mistakes, and our guide to document confidentiality covers the habits that prevent them.
What Are the Penalties Under Law 25?
Under Law 25, the CAI can impose administrative monetary penalties on businesses of up to $10 million CAD or 2% of worldwide turnover, whichever is greater. Penal fines, imposed by the courts, can reach $25 million CAD or 4% of worldwide turnover for businesses. These are among the highest privacy penalties in Canada.
The Quebec government’s September 2023 announcement gives both figures and says the law “considerably increases” the amounts of penal sanctions. The CAI notes that after a failure that could lead to an administrative penalty, a business can instead make an undertaking to the CAI to take the steps needed to fix it or reduce its consequences.
The maximums are for the worst cases. For a small business, the more realistic risk is an investigation, an order to change how it handles information, and the cost of notifying clients after an incident. All of that is avoidable with basic controls.
How Is Law 25 Different From PIPEDA?
PIPEDA is Canada’s federal private-sector privacy law; Law 25 updated Quebec’s own private-sector law, which applies instead of PIPEDA to businesses operating within Quebec. Information that crosses provincial or national borders is still subject to PIPEDA, so many businesses must follow both.
The Office of the Privacy Commissioner of Canada’s summary of privacy laws lists Alberta, British Columbia and Québec as the provinces with private-sector laws that apply instead of PIPEDA in some cases, and adds that “all businesses that operate in Canada and handle personal information that crosses provincial or national borders are subject to PIPEDA.” The biggest practical difference is enforcement:
| Quebec Law 25 | PIPEDA | |
|---|---|---|
| Regulator | Commission d’accès à l’information (CAI) | Office of the Privacy Commissioner of Canada (OPC) |
| Applies to | Businesses handling personal information in Quebec | Commercial activity across Canada, and information crossing borders |
| Incident threshold | Risk of serious injury | Real risk of significant harm |
| Incident records | Register of all incidents, kept 5 years | Records of all breaches |
| Named privacy lead | Person with highest authority by default; title and contact published | Organization must designate someone accountable |
| Fines | Regulator can impose penalties up to $10M CAD or 2%; penal fines up to $25M CAD or 4% | The OPC does not issue fines; offences are prosecuted federally |
On that last row, the OPC’s breach reporting guidance is explicit: “The OPC does not prosecute offences under PIPEDA or issue fines.” The CAI, by contrast, can impose administrative penalties itself. If your business is in Ontario and handles health information, PHIPA adds a third layer.
How Do You Share Personal Information Securely Under Law 25?
To share personal information securely under Law 25, send it through a channel that limits who can open it and for how long: a passphrase-protected link that expires, with the passphrase shared separately, rather than an email attachment that sits in inboxes indefinitely. Then record what you sent and to whom.
Law 25 requires security measures that are reasonable given the sensitivity, purpose, quantity, distribution and medium of the information. Email attachments struggle on every count: they can go to the wrong address, they are copied to every mailbox they pass through, and you cannot take them back. Our guide on how to send documents securely online compares the safer options.
This is where SureSend comes into the picture. SureSend is a Canadian secure file transfer service that sends files through a passphrase-protected link that expires on a date you choose. SureSend encrypts every file while it’s sent and while it’s stored (TLS in transit, AES-256 at rest). Here is exactly how it works:
- Create a transfer. Sign in, add one or more recipient email addresses, upload your files, and choose an expiry date of up to 21 days.
- Set a passphrase. SureSend emails each recipient a secure link, but the passphrase is never included in that email. You share it separately, by phone or text.
- The recipient downloads. They open the link, enter the passphrase, and download the files. They do not need a SureSend account.
- Track and control it. Your dashboard shows when the transfer is retrieved. You can cancel it before it is downloaded, and it expires automatically.
Each transfer allows one successful download. If the download is interrupted, the recipient can try again until one download completes; after that the link cannot be used again, and the transfer’s status updates to Retrieved.
If a transfer goes to the wrong person, you can cancel it from the dashboard before it is downloaded, which is exactly the kind of quick action Law 25 expects after an incident.
| Email attachment | SureSend | |
|---|---|---|
| Wrong recipient | Delivered instantly; cannot be recalled | Recipient still needs the passphrase; you can cancel before download |
| How long it lasts | Stays in inboxes indefinitely | Expires on a date you choose, up to 21 days |
| Record of delivery | None | Status shows Retrieved, Expired or Cancelled |
| Size | Limited by the email service | Up to 2 GB per transfer (Pro) |
| Encryption | Depends on the mail servers | TLS in transit, AES-256 at rest |
A secure transfer tool is one control among many; it does not make a business compliant on its own. Include it in your own assessment like any other service provider. The free Starter plan lets you try it, and Pro is $7 CAD/month plus applicable taxes.
Send Client Files Without Leaving Copies in Inboxes
SureSend encrypts every file while it’s sent and while it’s stored: TLS in transit and AES-256 encryption at rest. Send up to 2 GB per transfer, protect it with a passphrase you share separately, set an expiry of up to 21 days, and see when it is retrieved. Your recipient needs no account. New subscribers get 30 days of Pro free, with no credit card required. Start sending securely for free.
A Law 25 Checklist for Small Businesses
If you are starting from zero, this order covers the essentials:
- Name your person in charge of personal information (or confirm it is the owner) and publish the title and contact details on your website.
- List the personal information you hold, where it is stored and who can access it.
- Write a governance policy covering retention and destruction, staff roles and complaints, and publish a summary.
- Publish a privacy policy in clear and simple terms if you collect information online.
- Review your consent requests: one purpose at a time, in plain language, separate from other text.
- Run a privacy impact assessment before new systems and before sending information outside Quebec, including to cloud providers.
- Create your confidentiality incident register and a short response plan: contain, assess, notify, record.
- Replace email attachments for sensitive files with passphrase-protected links that expire.
Accountants and payroll teams will recognize the last step from tax season; it is the same discipline we describe for teams that send T4 slips.
Frequently Asked Questions
What is Quebec Law 25?
Quebec Law 25, formerly Bill 64, is the 2021 law that modernized Quebec’s privacy legislation. It requires organizations to name a person in charge of personal information, report serious confidentiality incidents, run privacy impact assessments and obtain clear consent, with penalties of up to $25 million CAD or 4% of worldwide turnover.
When did Law 25 come into effect?
Law 25 came into effect in three phases: September 22, 2022, September 22, 2023 (most provisions) and September 22, 2024 (data portability). All of its obligations for businesses are now in force.
Does Law 25 apply to small businesses?
Yes. Law 25 applies to every business that handles personal information in Quebec, regardless of size. The obligations should be proportionate to the sensitivity and amount of information held, but a small business still needs a person in charge, policies and an incident register.
Does Law 25 apply to businesses outside Quebec?
It can. If a business outside Quebec collects or uses personal information about people in Quebec in the course of its activities, it should plan to meet Law 25. Information that crosses provincial or national borders is also subject to the federal PIPEDA.
What are the fines under Law 25?
The Commission d’accès à l’information can impose administrative monetary penalties of up to $10 million CAD or 2% of worldwide turnover. Penal fines for businesses can reach $25 million CAD or 4% of worldwide turnover, whichever is greater.
Who is the person in charge of personal information under Law 25?
By default, it is the person with the highest authority in the business, such as the owner or CEO. That person can delegate the role in writing, and the title and contact information must be published on the business’s website.
Is Law 25 the same as the GDPR?
No. Law 25 is a Quebec law, while the GDPR is a European Union regulation. Law 25 introduced several similar ideas, such as privacy impact assessments, privacy by default and data portability, but the rules and the regulator are different.
What is Bill 64 in Quebec?
Bill 64 was the name of the bill before it was adopted in September 2021. Once adopted, it became Law 25, so the two names refer to the same privacy reform.
Sources
This article draws on the following sources.
- Commission d’accès à l’information du Québec. Principaux changements apportés par la Loi 25 (in French). cai.gouv.qc.ca
- Commission d’accès à l’information du Québec. Incidents de confidentialité et mesures de sécurité – entreprises (in French). cai.gouv.qc.ca
- Gouvernement du Québec. Loi 25 : certaines dispositions entrent en vigueur aujourd’hui, September 22, 2022 (in French). quebec.ca
- Gouvernement du Québec. Loi 25 : entrée en vigueur de nouvelles dispositions, September 22, 2023 (in French). quebec.ca
- Office of the Privacy Commissioner of Canada. Summary of privacy laws in Canada. priv.gc.ca
- Office of the Privacy Commissioner of Canada. What you need to know about mandatory reporting of breaches of security safeguards. priv.gc.ca
The Bottom Line
Quebec Law 25 is now fully in force. Every business that handles personal information in Quebec needs a named person in charge, published policies, privacy impact assessments, clear consent and an incident register, and the CAI can impose penalties of up to $10 million CAD or 2% of worldwide turnover. Most incidents start with an ordinary mistake, like a file sent to the wrong address.
Know your obligations. Then send personal information the careful way. Just SureSend it.
