Regulationsby GlyphQuebec Law 25
In force Quebec, Canada · In force Sep 22, 2022 · no upcoming deadlines
Deadlines
Phase 3: data portabilityRight to data portability in a structured, commonly used technological format applies.
Phase 2: main obligations and penaltiesGovernance policies, PIAs, consent, transparency, privacy by default, ADM notices, cross-border PIAs and AMP/penal regime apply.
Phase 1: privacy officer and incident reportingPerson in charge of personal information protection, confidentiality incident notification and register apply.
AssentBill 64 assented to as S.Q. 2021, c. 25.
Summaries for reference, not legal advice. Check the official text.
What it does
Overhauls Quebec's private-sector privacy law with GDPR-style duties: a designated person in charge of privacy, confidentiality incident reporting, privacy impact assessments (including before transfers outside Quebec), privacy by default, automated decision transparency, and data portability.
- Who it applies to
- Any enterprise collecting, holding, using or communicating personal information of individuals in Quebec in the course of carrying on an enterprise; no size threshold.
- Penalties
- Administrative monetary penalties up to CAD 10 million or 2% of worldwide turnover; penal fines up to CAD 25 million or 4% of worldwide turnover (whichever is greater), doubled for repeat offences; private right of action with punitive damages of at least CAD 1,000 for intentional or grossly negligent breaches.
- Enforced by
- Commission d'accès à l'information du Québec (CAI)
- Official name
- Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64)
- Citation
- S.Q. 2021, c. 25 (amending CQLR c. P-39.1)
- Topics
- Privacy, Breach notification, Biometrics
Verified 2026-09-22 cai.gouv.qc.ca
Research notes
Dates and penalties from well-established sources; LegisQuebec consolidation used as the official reference.
Related
Alberta POPAReplaces the privacy part of Alberta's FOIP Act for public bodies. It adds mandatory breach notification where there is a real risk of significant harm, privacy management programs, privacy impact assessments, rules for creating and using non-personal data, and notice when personal information will be fed into automated systems. It also bans selling personal information and adds large offence fines.In effect since Jun 11, 2025Argentina Law 25.326Argentina's habeas data and personal data protection law. It covers consent, data quality, sensitive data, security and confidentiality, international transfers to countries with adequate protection, and access, rectification and deletion rights. Argentina holds EU adequacy status based on this law.No date set
Brazil ECA DigitalRequires digital products and services likely to be accessed by children and adolescents to apply protection by design and default, reliable age verification, parental supervision tools, links between under-16 accounts and guardians, and swift removal of harmful content; bans profiling-based advertising to children and loot boxes in games for minors.In effect since Mar 17, 2026Brazil LGPDBrazil's GDPR-style general data protection law: ten legal bases, data subject rights, DPO (encarregado), incident reporting and international transfer rules. ANPD's Resolution CD/ANPD 19/2024 set the international transfer regime and mandatory standard contractual clauses.In effect since Sep 18, 2020
Canada Bill C-36 (PPCDA)Would replace PIPEDA's private-sector rules with a modernised statute (successor to C-27's CPPA) including stronger consent, de-identification and re-identification rules, and administrative penalties, with oversight housed in a new Digital Safety and Data Protection Commission. Does not include an AI act.No date setCanada Bill C-8 / CCSPARequires designated operators in federally regulated critical sectors to establish cyber security programs, mitigate supply-chain risks, report cyber incidents and comply with government cyber security directions; also amends the Telecommunications Act to let government order telecom providers to secure their networks.No date setChile Personal Data Protection Law (Ley 21.719)Replaces Chile's 1999 data law with a GDPR-style regime: legal bases, data subject rights (including portability and objection to automated decisions), security and breach notification, international transfer rules, a voluntary compliance (crime-prevention-style) model, and a new independent Personal Data Protection Agency.Next: Dec 1 Law in force · in 35 daysMexico LFPDPPP 2025New federal private-sector data protection law replacing the 2010 law after the dissolution of INAI; keeps the ARCO rights and privacy-notice model, broadens the personal data definition and moves enforcement to the Secretaría Anticorrupción y Buen Gobierno.In effect since Mar 21, 2025
Questions about Quebec Law 25
- What are the Quebec Law 25 compliance deadlines?
- Sep 22, 2021: Assent. Sep 22, 2022: Phase 1: privacy officer and incident reporting. Sep 22, 2023: Phase 2: main obligations and penalties. Sep 22, 2024: Phase 3: data portability.
- When does Quebec Law 25 take effect?
- Quebec Law 25 took effect on Sep 22, 2022.
- Who does Quebec Law 25 apply to?
- Any enterprise collecting, holding, using or communicating personal information of individuals in Quebec in the course of carrying on an enterprise; no size threshold.
- What are the penalties under Quebec Law 25?
- Administrative monetary penalties up to CAD 10 million or 2% of worldwide turnover; penal fines up to CAD 25 million or 4% of worldwide turnover (whichever is greater), doubled for repeat offences; private right of action with punitive damages of at least CAD 1,000 for intentional or grossly negligent breaches.