Law 25
Quebec law assented to in September 2021, progressively in force since 2022 and fully effective since September 2024. Governs the collection, use and sharing of personal information in Quebec, with a sanctions regime equivalent to the European GDPR.
What Law 25 is
Law 25 (“Act to modernize legislative provisions as regards the protection of personal information”) is Quebec’s major reform of personal data protection. It modernises the Act respecting the protection of personal information in the private sector and the Act respecting access to documents held by public bodies.
The regulator is the Commission d’accès à l’information du Québec (CAI), the Quebec equivalent of the French CNIL.
Phased rollout
- 22 September 2022 — designation of a person responsible for personal information mandatory, notification of confidentiality incidents.
- 22 September 2023 — informed consent, right to portability, increased transparency on automated decisions.
- 22 September 2024 — extended right to portability, full sanctions regime.
Key obligations
- Designation of a person responsible (DPO equivalent) at the highest level of the organisation.
- Written and communicated governance policy for personal information.
- Privacy impact assessment before any project impacting personal information.
- Notification to the CAI, within a reasonable delay, of confidentiality incidents presenting a serious risk of injury.
- Transparent information to the persons concerned.
Sanctions
Up to CAD $25M or 4% of worldwide annual turnover, whichever is higher. Regime comparable to that of the European GDPR.
Law 25 at Hexceos
Our Quebec presence (Montréal) operates in compliance with Law 25 and the federal PIPEDA. We support Quebec clients on compliance and documentation. See audit & compliance services.
Last updated: 19 May 2026