Quebec Law 25
In force Quebec, Canada · In force Sep 22, 2022 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.
- Who it applies to
- Any enterprise collecting, holding, using or communicating personal information of individuals in Quebec in the course of carrying on an enterprise; no size threshold.
- Penalties
- Administrative monetary penalties up to CAD 10 million or 2% of worldwide turnover; penal fines up to CAD 25 million or 4% of worldwide turnover (whichever is greater), doubled for repeat offences; private right of action with punitive damages of at least CAD 1,000 for intentional or grossly negligent breaches.
- Enforced by
- Commission d'accès à l'information du Québec (CAI)
- Official name
- Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64)
- Citation
- S.Q. 2021, c. 25 (amending CQLR c. P-39.1)
- Topics
- privacy, breach-notification, biometrics
Verified 2026-09-22 cai.gouv.qc.ca
Research notes
Dates and penalties from well-established sources; LegisQuebec consolidation used as the official reference.
Related
Questions about Quebec Law 25
- What are the Quebec Law 25 compliance deadlines?
- Sep 22, 2021: Assent. Sep 22, 2022: Phase 1: privacy officer and incident reporting. Sep 22, 2023: Phase 2: main obligations and penalties. Sep 22, 2024: Phase 3: data portability.
- When does Quebec Law 25 take effect?
- Quebec Law 25 took effect on Sep 22, 2022.
- Who does Quebec Law 25 apply to?
- Any enterprise collecting, holding, using or communicating personal information of individuals in Quebec in the course of carrying on an enterprise; no size threshold.
- What are the penalties under Quebec Law 25?
- Administrative monetary penalties up to CAD 10 million or 2% of worldwide turnover; penal fines up to CAD 25 million or 4% of worldwide turnover (whichever is greater), doubled for repeat offences; private right of action with punitive damages of at least CAD 1,000 for intentional or grossly negligent breaches.