Québec Law 25 for small businesses: what changed and what to do

Québec's Law 25 (Bill 64, adopted in 2021) rewrote the province's Act respecting the protection of personal information in the private sector. Its changes came into force in three steps, on 22 September 2022, 2023 and 2024. A small business that handles personal information about people in Québec now has to name a person in charge, keep an incident register, publish a governance policy and a privacy policy, run privacy impact assessments, keep identifying or profiling features off until people activate them, and answer requests within 30 days.

This guide walks through each obligation with the section of the Act it comes from, then gives a checklist. It is general information, not legal advice. The Act is quoted from the official LegisQuébec version, up to date as of 15 October 2026 when we checked it on 8 November 2026.

#What is Law 25, and who does it apply to?

"Law 25" is the short name of the Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25). It amended several laws. For businesses, the one that matters is the private sector act, chapter P-39.1.

Section 1 says the Act applies to personal information that a person "collects, holds, uses or communicates to third persons in the course of carrying on an enterprise". It applies whatever the medium, and whether you keep the information yourself or through a service provider. There is no size threshold: a sole trader and a large company have the same core duties, although some duties (such as impact assessments) are meant to be proportionate.

The Act does not set out a territorial test in plain terms. If you are outside Québec but collect information about people there, treat Law 25 as potentially applicable and get advice on your own case. In the rest of Canada, the federal PIPEDA or a provincial law may also apply.

The regulator is the Commission d'accès à l'information (CAI).

#When did each part come into force?

The Québec government announced the 2022 and 2023 steps on its website on the day each took effect. The portability right followed on the third anniversary, 22 September 2024.

#Who is the "person in charge of the protection of personal information"?

Under section 3.1, the business is responsible for protecting the personal information it holds. By default, the person exercising the highest authority in the business (often the owner or CEO) is the person in charge. That person may delegate all or part of the function in writing to anyone, inside or outside the company.

The title and contact information of the person in charge must be published on the business's website, or made known by other appropriate means if there is no website.

The role is not decorative. Section 3.3 requires that the person in charge be consulted "from the outset" of any project covered by an impact assessment.

#What happens when there is a confidentiality incident?

Law 25 uses "confidentiality incident" where the GDPR says "personal data breach". It covers unauthorised access, use or communication of personal information, and its loss.

• Act quickly: take reasonable measures to reduce the risk of injury and prevent new incidents (section 3.5).
• Assess the risk: consider in particular the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes (section 3.7).
• Notify serious incidents: if there is a risk of serious injury, promptly notify the CAI and the people affected (section 3.5).
• Record every incident: keep a register of confidentiality incidents (section 3.8), including those that are not notified.

The Regulation respecting confidentiality incidents sets out the details. The written notice to the CAI includes, among other items, a description of the information, the circumstances, when the incident happened and was discovered, the number of people affected and how many live in Québec, and the measures taken. Each register entry must record the reasoning behind your risk decision and must be kept for at least five years after you became aware of the incident.

There is no fixed number of hours like the GDPR's 72. "Promptly" is the test.

#What must you publish?

Law 25 asks for two different public documents.

A governance policy (section 3.2). You must establish and implement governance policies and practices for personal information, and publish detailed information about them in clear and simple terms. They must provide a framework for keeping and destroying the information, define the roles and responsibilities of staff through its life cycle, and set out a process for handling complaints.

A privacy policy (section 8.2). If you collect personal information by technological means, such as a website or app, you must publish a confidentiality policy in clear and simple language, and publish notices of any amendment the same way.

Section 8 also lists what you must tell people when you collect their information: the purposes, the means of collection, their rights of access and correction, and their right to withdraw consent, among others.

#Do you need a privacy impact assessment?

Yes, in two common situations:

1. New or overhauled systems (section 3.3). Any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information. The project must also allow computerised information to be returned in a structured, commonly used format.
2. Communication outside Québec (section 17). Before you communicate personal information outside Québec, including to a cloud provider or a service provider in another province or country. The communication may go ahead only if the assessment shows the information would receive adequate protection, and it must be the subject of a written agreement.

The assessment must be proportionate to the sensitivity of the information, the purposes, the quantity and distribution of the data and the medium. For a small business adopting a standard tool, that can be a short written assessment.

#What does Law 25 say about cookies and tracking?

Section 8.1 targets technology with functions that can identify, locate or profile a person. Before collecting information with it, you must inform the person of the use of the technology and of "the means available to activate" those functions. The Act defines profiling as using personal information to assess characteristics such as work performance, economic situation, health, preferences, interests or behaviour.

Since people must be told how to activate those functions, the Act is generally read as requiring them to be off by default. In practice, that is why many businesses keep analytics and advertising tags off for visitors in Québec until the visitor opts in.

Section 9.1 separately requires that products and services offered to the public provide the highest level of confidentiality by default. That section states it does not apply to privacy settings for browser cookies, which section 8.1 covers instead.

#What rights do people in Québec have?

• Access and correction, with a reply within 30 days of receiving the request. Failing to respond within 30 days is deemed a refusal (section 32).
• Portability: computerised information collected from the person (not information you created or inferred), in a structured, commonly used technological format, unless that raises serious practical difficulties. At the person's request, it goes to them or to any person or body authorised by law to collect it (section 27, since 22 September 2024).
• De-indexing: asking a business to stop disseminating information or to de-index a hyperlink attached to their name, where the dissemination breaks the law or a court order. It can also apply where the dissemination causes serious injury that clearly outweighs the public interest in knowing the information, and the request goes no further than necessary (section 28.1).
• Automated decisions: if a decision is based exclusively on automated processing, the person must be told no later than when they are informed of the decision, and can ask for the information used, the reasons and principal factors behind the decision, and its correction (section 12.1).
• Consent must be clear, free and informed and given for specific purposes (section 14). It must be express for sensitive information, meaning information with a high reasonable expectation of privacy, such as medical or biometric data (section 12). For a minor under 14, consent comes from a parent or tutor (sections 4.1 and 14).

When the purposes are achieved, the information must be destroyed or anonymised (section 23), following the government's anonymisation regulation.

#What are the penalties?

For an individual, the administrative penalty is capped at CAD 50,000 and penal fines range from CAD 5,000 to 100,000.

#Checklist: Law 25 for a small business

• Decide who is the person in charge; if not the top executive, delegate in writing.
• Publish their title and contact details on your website.
• Set up a confidentiality incident register and a simple response procedure.
• Write and publish your governance policy: roles, retention and destruction, complaints.
• Publish a privacy policy in clear and simple language, and tell people when it changes.
• List the vendors and systems that store information outside Québec, and run an impact assessment with a written agreement for each.
• Run an impact assessment before adopting or overhauling any system that holds personal information.
• Keep identifying, locating and profiling features (analytics, ads, location) off until the person turns them on.
• Ask for express consent for sensitive information, and parental consent under 14.
• Set up a request process that replies within 30 days, including portability exports.
• Decide retention periods, then destroy or anonymise at the end.
• Review all of this once a year and each time you add a tool.

#How Privacyboard handles Québec

In Privacyboard, companies established in Canada get a governance policy written from their register and profile, visitors in Québec are always asked for consent by the cookie banner, and requests from Québec show the 30-day deadline with no extension.

#FAQ

#Is Law 25 the same as the GDPR?

No. They share ideas (impact assessments, breach notification, portability, privacy by default), but the rules differ. Law 25 has no 72-hour deadline, names a "person in charge" rather than a DPO, requires an impact assessment before any communication outside Québec, and gives 30 days to answer requests where the GDPR gives one month.

#Does Law 25 apply to a business with no office in Québec?

The Act does not state a territorial test in plain terms. If you collect personal information about people in Québec in the course of business, treat the law as potentially applicable and check with a lawyer.

#Who is the person in charge if we never chose one?

By default, the person exercising the highest authority in the business, under section 3.1. They can delegate the function in writing.

#Do we have to notify every incident to the CAI?

No. Only incidents that present a risk of serious injury must be notified to the CAI and to the people affected. Every incident, notified or not, goes in the register, kept at least five years.

#Do we need a cookie banner for visitors in Québec?

Section 8.1 requires you to inform people before using technology that can identify, locate or profile them, and to tell them how to activate those functions. Keeping those tags off until the visitor agrees is the common way to meet it.

#Can we extend the 30-day deadline for an access request?

Section 32 sets a 30-day reply deadline, and silence after 30 days is deemed a refusal. Plan to answer within 30 days.

#Sources

• Act respecting the protection of personal information in the private sector (P-39.1), LegisQuébec, up to date as of 15 October 2026
• Regulation respecting confidentiality incidents (A-2.1, r. 3.1), LegisQuébec
• Regulation respecting the anonymization of personal information (A-2.1, r. 0.1), LegisQuébec
• Gouvernement du Québec, Loi 25 : certaines dispositions entrent en vigueur aujourd'hui, 22 September 2022
• Gouvernement du Québec, Loi 25 : entrée en vigueur de dispositions qui rehaussent la protection de la vie privée des Québécois, 22 September 2023
• DLA Piper, Right to data portability in Québec, 25 September 2024