What is Law 25?
Law 25, officially the Act to modernize legislative provisions as regards the protection of personal information, came into force gradually starting in September 2022. Since September 2024, all of its provisions are in force.
It's the Quebec equivalent of Europe's GDPR. It strengthens citizens' rights over their personal data and imposes strict obligations on businesses that collect, use or share that data.
Who's affected?
Every business that collects personal information in Quebec, no matter:
- Its size (even self-employed workers)
- Its industry
- Whether it's incorporated or not
- The number of clients or employees
The 8 main obligations
Name a person in charge of the protection of personal information (RPRP)
By default, that's the business owner. You can delegate the role to an employee. The RPRP's name and contact info must be available on your website.
Publish a privacy policy
It has to be written in clear, simple terms. It must explain what data you collect, why, how you protect it and how to have it deleted.
Get explicit consent
Before collecting personal information, you have to get the person's clear consent. Pre-checked boxes are NOT valid consent.
Limit collection to what's necessary
Only collect information that's strictly necessary for your activities. If you don't need the date of birth, don't ask for it.
Keep an incident log
In case of a data leak or privacy incident, you have to document it in a log and notify the Commission d'acces a l'information (CAI) and the people affected.
Run a privacy impact assessment (PIA)
Before any new project involving personal information (a new form, new software, etc.), assess the risks to privacy.
Respect the right to portability
People can ask to receive their data in a structured, commonly used format, or to transfer it to another organization.
De-indexing and the right to be forgotten
People can ask to have their data deleted and their information de-indexed from search engines in certain cases.
Full compliance checklist
Penalties for non-compliance
Law 25 provides for severe penalties:
Tools to get compliant
- Privacy policy generator — build your Law 25-compliant policy in 2 minutes
- Law 25 policy template — a template ready to customize
