Quebec Law 25: Requirements, Penalties and Compliance in 2026

Quebec's Law 25 is now fully in force. The legislation significantly changed Quebec's private-sector privacy rules, introducing stronger requirements around consent, privacy governance, impact assessments, data subject rights, incident management, and data portability.

If your organization handles the personal information of people in Quebec, this guide explains who Law 25 applies to, its core requirements, how enforcement works, and what businesses should review in 2026.

What is Quebec's Law 25?

Quebec's Law 25, formally An Act to modernize legislative provisions as regards the protection of personal information and originally introduced as Bill 64, is a set of amendments to Quebec's Act respecting the protection of personal information in the private sector. It governs how private-sector organizations collect, use, retain, and share people's personal information in Quebec. It is widely considered one of Canada's strictest privacy regimes.

The law was passed in September 2021 and phased in over three years starting in September 2022. It is overseen by the Commission d'accès à l'information du Québec (CAI), the province's independent privacy regulator, which investigates complaints, audits organizations, and issues penalties.

For a fast reference on scope, timeline, and enforcement, see Clym's Quebec Law 25 regulation summary.

Who has to comply with Quebec's Law 25?

Law 25 applies to any person or entity "carrying on an enterprise" in Quebec, a standard drawn from Quebec's Civil Code that covers organized economic activity, not only registered corporations.

• Private-sector businesses that collect, use, or disclose personal information about people in Quebec.
• Nonprofits, associations, and professional orders operating an enterprise, to the extent set out in the Professional Code.
• Organizations based outside Quebec may also be subject to Law 25, depending on factors such as the nature of their activities and their connection to Quebec. This is a fact-specific question, and organizations with cross-border operations should confirm their status with legal counsel.

Unlike laws such as the CCPA, Law 25 sets no minimum revenue or headcount threshold for coverage. The main exemptions are public bodies, which fall under a separate access-to-information law, and purely personal or domestic use of information.

When did Quebec Law 25 take effect?

Law 25's obligations were introduced in three phases between 2022 and 2024. All three are now active, so treat every item in this guide as a current obligation, not a future deadline.

Core requirements under Quebec's Law 25

The phased rollout is complete, so organizations should now treat the following as ongoing privacy obligations rather than a one-time project.

Appoint and publish a privacy officer

Every organization covered by Law 25 must designate a privacy officer responsible for protecting personal information. If no one is appointed, that responsibility defaults to whoever exercises the highest authority in the organization, typically the CEO. You can delegate the role in writing to any staff member or outsource it entirely, but you must publish the person's title and contact information on your website or make it available by other appropriate means.

Collect valid, specific consent

Consent under Law 25 must generally be requested separately from other information, presented in clear and simple language, and obtained before collection, subject to specific exceptions set out in the Act. For children aged 14 or under, consent must come from a parent or legal guardian, and people must be able to withdraw consent as easily as they gave it.

A cookie banner that defaults to tracking before a visitor chooses is unlikely to meet Law 25's consent standard. See our cookie consent banner guide for what a compliant flow looks like.

See how Clym's consent management platform can help you support Law 25's consent requirements across every jurisdiction you operate in.

Publish a plain-language privacy policy

Any organization collecting personal information through technological means, including a website, must display a privacy policy written in clear, straightforward terms and keep it current as practices change.

Give people control over their data, including portability

Law 25 grants Quebec residents the right to access, correct, or request the destruction of their personal information, the right to de-indexation and cessation of dissemination (Quebec's version of the right to be forgotten), and, since September 2024, the right to data portability.

Portability requests must be fulfilled within 30 days, using a structured, commonly used, machine-readable format such as CSV, XML, or JSON. Before releasing data to a third party at the individual's request, the organization receiving it must also confirm that the third party is legally entitled to collect it, a nuance Osler's analysis of the portability right breaks down in more detail.

Clym's data subject request management solution helps route, verify, and track access, correction, and portability requests against the 30-day deadline.

Conduct privacy impact assessments

Law 25 requires a privacy impact assessment (PIA) before certain projects involving the collection, use, or communication of personal information, particularly projects involving new technology, profiling, or the transfer of personal information outside Quebec. Requirements and exceptions vary by project type, so organizations should confirm the specifics against the statutory text or with legal counsel. The assessment should document the purpose of the processing, the risks involved, and the measures taken to address them.

Build a confidentiality incident response process

Organizations must have a documented process for detecting, containing, and reporting confidentiality incidents that pose a risk of serious harm, including notifying both the CAI and affected individuals. Incident response is also where recent CAI activity is worth watching closely, covered in the enforcement section below.

Handle biometric data with extra caution

Any organization planning to use biometric characteristics, such as facial recognition or fingerprint scanning, to verify or identify a person must notify the CAI in advance. This is one of the areas where the CAI has been most active, a trend covered in more detail below.

Assess cross-border data transfers

Before personal information is transferred outside Quebec, whether to a cloud provider, a US-based vendor, or a parent company abroad, organizations must complete a privacy impact assessment confirming the data will receive adequate protection and inform the individual concerned.

How does Quebec's Law 25 compare with GDPR and PIPEDA?

Businesses already subject to the GDPR or PIPEDA may recognize several Law 25 requirements, but the frameworks do not fully overlap.

Consent language, biometric notification, and the de-indexation right differ from GDPR in detail, so organizations should not assume full overlap even where a GDPR program already exists.

What happens if you do not comply? Penalties and enforcement

Law 25 uses a two-tier penalty system. The CAI can issue administrative monetary penalties directly, up to $10 million CAD or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. For more serious violations, Quebec's courts can pursue penal fines of up to $25 million CAD or 4% of worldwide turnover.

Osler's overview of the enforcement scheme notes that penal proceedings are generally reserved for cases involving serious harm, vulnerable individuals, sensitive information, intent or negligence, or an organization that obstructs the CAI's investigation. For individuals, not organizations, administrative penalties are capped at $50,000 CAD and penal fines at $100,000 CAD.

Enforcement activity has picked up alongside the phased rollout. In one notable shift, the CAI stopped publishing its public list of organizations that reported confidentiality incidents as of May 2025, though it still publishes aggregate statistics. The reporting obligation itself has not softened, only its visibility to the public.

The CAI has also been active on biometrics specifically. Recent orders have required organizations to stop using facial recognition systems for tasks as routine as employee access control, a trend Osler's biometrics analysis describes as the CAI continuing to set a high bar.

Common Quebec Law 25 compliance mistakes

• Assuming GDPR compliance automatically extends to Law 25, without checking Quebec-specific requirements.
• Assuming a small business exemption exists. Law 25 has no revenue or size threshold.
• Using consent practices, such as pre-checked tracking boxes, that do not reflect Law 25's consent standard.
• Overlooking Quebec-specific requirements, such as mandatory biometric notification or the right to data portability.

Need a practical, step-by-step checklist?

This guide covers what Law 25 requires and why. For a shorter, action-oriented walkthrough you can use to review your own privacy program item by item, see Clym's Quebec Law 25 compliance checklist.

View the Quebec Law 25 compliance checklist

How Clym can help with Quebec Law 25 compliance

Clym helps organizations manage privacy requirements across consent, policies, data subject requests, and privacy governance. ReadyCompliance^® supports preconfigured settings for 190+ privacy regulations, including Quebec Law 25, while the Governance Portal provides a central place to manage privacy workflows. Clym's policy management solution can also help keep bilingual privacy and cookie policies current as your practices change.

Conclusion

Quebec's Law 25 is no longer in a phased implementation period. Organizations subject to the law should treat privacy governance, consent, impact assessments, incident management, and privacy rights requests as ongoing operational responsibilities, not a one-time checklist.

Regularly reviewing these processes can help identify gaps as technology, vendors, data practices, and regulatory guidance change.