Rule 6 of 33

Quebec Law 25 (privacy)

What do I have to do to comply with Quebec Law 25?

Law 25 requires a named privacy officer, a published privacy policy, express consent for collecting personal information, breach reporting, and a privacy impact assessment before new technology projects. It applies to any organisation handling the personal information of people in Quebec, including sole proprietors.

What the rule requires

Grace period over. First CAI notice Aug 2025.

Who it catches

Any org handling one Quebec resident’s personal data. Up to $25M or 4% of revenue; s.93.1 lets individuals sue directly.

What this looks like in practice. You have one customer in Montreal and you store their data, but no posted privacy policy and no named privacy officer. The CAI can act on its own - it already ordered a company to tear out its facial-recognition door system.

How to check whether you comply

The checkConfirm you have: a posted privacy policy, a named privacy officer, a breach-response plan, and a PIA for any sensitive processing.

Read it yourself

We would rather you checked us than took our word for it. This links to the law as published, not to our summary of it.

Primary source CAI ↗ Real case CAI ordered a firm to drop facial recognition; first public finding Aug 2025 ↗

Questions people ask

What do I have to do to comply with Quebec Law 25?

Law 25 requires a named privacy officer, a published privacy policy, express consent for collecting personal information, breach reporting, and a privacy impact assessment before new technology projects. It applies to any organisation handling the personal information of people in Quebec, including sole proprietors.

Who does Quebec Law 25 (privacy) apply to?

Any org handling one Quebec resident’s personal data. Up to $25M or 4% of revenue; s.93.1 lets individuals sue directly.

How do I check whether we comply with Quebec Law 25 (privacy)?

Confirm you have: a posted privacy policy, a named privacy officer, a breach-response plan, and a PIA for any sensitive processing. You can also run our free website check, which tests 25 technical items in about twenty seconds, or book a review if this rule needs a documented answer.

Other rules that catch the same businesses

Rule 7BC / Alberta PIPA (employee data) Rule 8Ontario job posting rules (O. Reg. 476/24) Rule 9Multi-jurisdiction posting conflict Rule 10BC Pay Transparency Act All of themThe full 33-rule table, searchable

Find out which of the 33 apply to you

The fine risk check asks a few questions about your business and tells you which rules catch you, with the deadlines. Nothing you tick leaves your browser.

Check my fine risk

This page summarises a legal obligation in plain language so you can work out whether it applies to you. It is not legal advice, and the primary source linked above governs. Last reviewed 2026-10-03.