Quebec Law 25

What it is

Law 25 (formerly Bill 64) is Quebec's comprehensive privacy modernization act, adopted September 22, 2021. It amends the Act Respecting the Protection of Personal Information in the Private Sector (P-39.1) and the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information. Enforced by the Commission d'accès à l'information (CAI), it introduces GDPR-adjacent requirements, including mandatory reporting of confidentiality incidents.

Who it applies to

Any enterprise or public body collecting, holding, using, or disclosing personal information of Quebec residents, regardless of where the enterprise is headquartered. Extraterritorial reach mirrors the GDPR pattern: if you offer goods or services to Quebec residents or monitor their behaviour, you are covered.

Key provisions

Phased implementation

• September 22, 2022 (Phase 1): Mandatory Privacy Officer designation; breach reporting to the CAI; incident register; breach notification to affected individuals; safeguards proportionate to sensitivity
• September 22, 2023 (Phase 2): Consent requirements; automated decision-making transparency; privacy by default; data portability; privacy impact assessments for high-risk projects
• September 22, 2024 (Phase 3): Right to data portability fully in force

Key data protection requirements

Enterprises must designate a person in charge of privacy (default: the person exercising the highest authority), maintain records of processing, conduct privacy impact assessments (PIAs) before implementing information systems or communicating personal information outside Quebec, and obtain express consent for sensitive personal information. Cross-border transfers require a PIA and can be blocked if the destination does not provide adequate protection.

Breach reporting

Following a confidentiality incident, enterprises must:

• Notify the CAI and affected individuals promptly if the incident presents a risk of serious injury (section 3.5)
• Maintain a register of all confidentiality incidents (regardless of severity), the CAI can request the register (section 3.8)
• Take reasonable measures to reduce the risk of injury and prevent recurrence

Enforcement

The Commission d'accès à l'information may impose administrative monetary penalties, for example on an enterprise that does not report a confidentiality incident where required (section 90.1). Failing to report where required, or failing to take the security measures section 10 requires, is also a penal offence (section 91). In setting a penalty, the Act requires weighing the seriousness and duration of the failure, whether it was intentional or negligent, whether reasonable measures were taken, the number of people concerned and the enterprise's ability to pay (sections 90.2 and 92.3). Where an unlawful infringement of a right under the Act causes an injury and is intentional or results from a gross fault, a court awards punitive damages (section 93.1).

Recent amendments

• Sep 2022Phase 1 in force, breach reporting, privacy officer designation, incident register.
• Sep 2023Phase 2 in force, consent, transparency, PIA requirements.
• Sep 2024Phase 3 in force, data portability rights.

How LeakTrace maps to it

An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to Quebec Law 25, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.