Your Law 25 Obligations & Timeline

The Three Phases

Phase 1: In force since September 22, 2022

Governance & incident reporting

This phase set up the basic governance structure every organization needs:

Designate a person responsible for the protection of personal information (defaults to your most senior person unless delegated)
Publish that person’s title and contact information
Maintain an internal register of every confidentiality incident, regardless of severity
Notify the CAI and affected individuals, without delay, of any incident that presents a serious risk of harm

Phase 2: In force since September 22, 2023

Policies, consent & assessments

This was the largest phase, covering how you collect, use, and govern personal information:

Publish a privacy policy and internal governance rules for personal information
Give clear, plain-language notice when collecting personal information
Limit collection to what’s necessary for a stated purpose, and avoid bundling consent with terms of service
Destroy or anonymize personal information once it’s no longer needed
Conduct privacy impact assessments (PIAs) before acquiring or redesigning systems that handle personal information, and before transferring data outside Quebec
Meet stricter consent standards, including for sensitive information

Phase 3: In force since September 22, 2024

Data portability

The final phase gave individuals new rights over the personal information they’ve provided to you:

Individuals can request a copy of the computerized personal information you hold about them, in a structured, commonly used format
In some cases, they can ask that this information be transferred directly to another organization, where it’s technically feasible to do so

This right applies to information collected from the individual themselves, and the transfer requirement only applies where it’s technically feasible. It doesn’t require you to build new integrations on demand.

Ongoing Obligations in Detail

Privacy officer

Every organization needs someone whose job includes protecting personal information. For most SMBs this is the owner or a senior manager, not a dedicated hire. The key requirements are that the role is assigned, documented, and that people know how to reach this person with privacy questions or requests.

Incident register

Confidentiality incidents include things like a lost laptop, an email sent to the wrong recipient, or a phishing compromise of an employee mailbox. Every one of these should be logged, even if it doesn’t rise to the level of requiring notification. The register itself can be requested by the CAI during an investigation.

Privacy impact assessments (PIAs)

A PIA doesn’t need to be a massive document. For most SMBs it’s a short, structured review: what personal information is involved, who has access, where it’s stored, what the risks are, and how those risks are mitigated. The trigger points are new systems, major changes to existing systems, and any transfer of personal information outside Quebec, including to cloud services hosted elsewhere in Canada or the US.

Consent

Consent has to be specific to its purpose, given freely, and easy to withdraw. Pre-checked boxes, consent buried in lengthy terms, or a single blanket “I agree” covering multiple unrelated uses of data don’t meet the standard anymore.

Confidentiality by default

If you offer a technology product or service to the public, a website with tracking, an app, a customer portal, its privacy settings must default to the highest level of confidentiality. Analytics that run before consent and pre-checked tracking boxes both fail this test.

Retention & destruction

Once personal information is no longer needed for the purpose it was collected for, it should be destroyed or anonymized. This means having a rough idea of how long you keep different categories of data (employee records, customer files, marketing lists) and a process to actually act on it, rather than keeping everything indefinitely by default.

Anonymization has its own rulebook. Since May 30, 2024, Quebec’s Anonymization Regulation requires documented methods, generally accepted best practices, and a re-identification risk analysis before data counts as anonymized. For most SMBs, secure destruction is the simpler path. More on anonymization →

Your Law 25 Obligations