Quebec Privacy LawGuide for Small Business
Straight answers to the questions Quebec small businesses ask most about Law 25.
· IT & cybersecurity for Quebec SMBs since 1995
Law 25 (formerly Bill 64) is Quebec’s modernized private-sector privacy law. It updates the rules for how organizations collect, use, store, and disclose personal information, and gives Quebec residents new rights over their data.
Yes. There’s no minimum size threshold. If your business collects or stores personal information about employees, customers, suppliers, or website visitors in the course of business in Quebec, Law 25 applies to you.
Yes. Law 25 was rolled out in three phases between September 2022 and September 2024, and all three phases are now in effect.
Any information that relates to an identifiable individual: names, email addresses, phone numbers, home addresses, employee records, customer files, and in some contexts online identifiers like IP addresses.
Yes. Every organization must designate someone responsible for protecting personal information, and publish that person’s title and contact information. By default, this responsibility falls to the most senior person in the organization unless it’s formally delegated.
Yes. You must keep an internal register of every confidentiality incident involving personal information, regardless of how minor it seems. This register can be requested by the CAI during an investigation.
If a confidentiality incident poses a serious risk of harm to affected individuals, you must notify the CAI and the affected individuals without delay. Law 25 doesn’t set a fixed numeric deadline, but the standard is prompt action, not a delayed or routine notification.
Administrative monetary penalties can reach $10 million CAD or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines for the most serious offences can reach $25 million CAD or 4% of worldwide turnover, whichever is greater, and can double for repeat offences.
Yes. Beyond CAI penalties, Law 25 created a private right of action. When an unlawful infringement causes injury, individuals can claim damages, and courts must award punitive damages of at least $1,000 per person when the infringement is intentional or results from gross fault. For a breach affecting hundreds of customers, that adds up faster than any regulatory fine.
A PIA is a structured review of the privacy risks of a project. You need one before acquiring, developing, or significantly redesigning a system that handles personal information, and before transferring personal information outside Quebec, including to cloud services hosted elsewhere in Canada or the US.
Consent must be clear, specific to its purpose, and given separately from general terms of service. Pre-checked boxes and consent bundled into unrelated purposes no longer meet the standard, and individuals must be able to withdraw consent.
Non-essential cookies and trackers (analytics, advertising) need opt-in consent. Law 25 also requires that technology products and services offered to the public default to the highest level of confidentiality, so pre-enabled tracking fails on two counts. Cookies strictly necessary to make the site work don’t need consent. The banner on this site works the way the CAI expects: analytics stays off until you accept.
Yes. Information that is sensitive by nature, like health or financial details or biometric data, requires express consent: a clear, affirmative yes for that specific use. Implied or opt-out consent isn’t enough, and sensitivity also raises the bar for how the information must be protected.
Individuals can request a copy of the computerized personal information you collected from them, in a structured, commonly used format. In some cases they can ask for it to be transferred directly to another organization, where technically feasible.
Individuals can ask an organization to stop disseminating their personal information, or to de-index any hyperlink attached to their name, where dissemination breaks the law or a court order, or where it causes serious harm to reputation or privacy that clearly outweighs the public interest. Most SMBs will rarely receive such a request, but you need a way to handle one, typically through your privacy officer.
Yes. Once personal information is no longer needed for the purpose it was collected for, it should be destroyed or anonymized, in line with retention periods you define for each category of data.
Yes. Since May 30, 2024, Quebec’s Anonymization Regulation sets a formal process: anonymization must follow generally accepted best practices, include a documented re-identification risk analysis, and be recorded. Stripping names out of a spreadsheet doesn’t make it anonymized. If you can’t meet that bar, securely destroying the data is usually the simpler route.
Your vendors aren’t directly regulated by Law 25 in the same way you are, but you remain responsible for personal information you share with them. Vendor contracts should include privacy and security obligations and breach notification requirements.
The Commission d’accès à l’information (CAI), Quebec’s privacy regulator, oversees compliance, investigates complaints, and can issue administrative monetary penalties.
Law 25 applies to organizations doing business in Quebec and to personal information collected in Quebec, regardless of where the organization itself is based or where its other customers are located.
PIPEDA is the federal private-sector privacy law that applies to commercial activity across Canada. Quebec has enacted its own private-sector privacy law (Law 25), which has been deemed “substantially similar” to PIPEDA. As a result, Quebec organizations operating within provincial jurisdiction are generally exempt from PIPEDA and governed by Law 25 instead.
Bill C-36, introduced in June 2026, is proposed federal legislation that would replace PIPEDA with a new law called the Protecting Privacy and Consumer Data Act (PPCDA). It is currently at first reading and has not yet become law.
If passed, it would be the most significant overhaul of Canada’s federal private-sector privacy framework in over 25 years. For Quebec organizations, the key question is whether Law 25 will be deemed “substantially similar” to the PPCDA, the same status it holds under PIPEDA today. If it is, Quebec organizations will continue to be governed primarily by Law 25 for provincially regulated activities. If it isn’t, PPCDA would apply alongside Law 25.
No determination has been made yet. Law 25 compliance remains the current priority. Check back here for updates as the legislation progresses.
Start with a privacy officer designation and a basic incident register, since these are the most commonly checked items. From there, work through a structured checklist covering policies, consent, retention, PIAs, vendor contracts, and security safeguards.
No. This is an independent educational resource for small businesses. For official guidance, consult the Commission d’accès à l’information (CAI) or a qualified privacy lawyer.