Québec’s Law 25, without a separate setup.
Law 25 applies to businesses handling personal information of people in Québec, with fines up to 4% of worldwide turnover. Add Canada in your profile: Privacyboard adds the notice, the 30-day deadline and consent first in the banner.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Businesses handling personal information of people in Québec
- Maximum penalty
- CAD 25 million or 4% of worldwide turnover (penal)
- Deadline
- 30 days per request, no extension
- In Privacyboard
- On every plan, Free included
What Law 25 asks, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
Their title and contact, on your website. By default, your top executive.
In Privacyboard
Shown in your policy and privacy center from your profile.
Every plan
Show all 6 duties as a list
s. 3.1Publish the person in chargeEvery plan
What the law asks: Their title and contact, on your website. By default, your top executive.
In Privacyboard: Shown in your policy and privacy center from your profile.
s. 3.2Publish a governance policyEvery plan
What the law asks: Your rules for handling personal information, in clear terms, on your website.
In Privacyboard: Drafted for companies established in Canada, from your register and profile.
s. 8A notice for QuébecEvery plan
What the law asks: Purposes, means, rights, and storage outside Québec.
In Privacyboard: A Canada and Québec section added to your policy.
s. 32Answer within 30 daysEvery plan
What the law asks: No reply within 30 days counts as a refusal.
In Privacyboard: Québec in the request form, 30 days, no extension. Request form on Pro.
s. 3.5, 3.8Handle confidentiality incidentsEvery plan
What the law asks: Notify the CAI and people when there is a risk of serious injury, and keep a register.
In Privacyboard: The breach register names the CAI and keeps every incident.
s. 8.1Tracking people activateEvery plan
What the law asks: Functions that identify, locate or profile must be ones the person activates.
In Privacyboard: Visitors in Québec are always asked before trackers run.
The numbers to know
or 4% of worldwide turnover, the top penal fine
or 2% of turnover, the top administrative penalty
to answer a request, with no extension
Before sending personal information outside Québec, a privacy impact assessment is required (s. 17).
How Law 25 arrived
Person in charge
And incident reporting.
Most duties
Policies, consent, assessments, fines.
Portability
Data in a structured format.
What Privacyboard covers, and what it does not
Covered
- A governance policy, for companies established in Canada
- A Canada and Québec notice in your policy
- Québec in the request form, 30 days
- The person in charge published
- Incident register naming the CAI
- Consent first for visitors in Québec
Not covered
- The privacy impact assessment before transfers outside Québec
- A French version of every document
- Notifying the CAI for you
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Add Canada
In Company profile, Activity.
- 2
Name the person in charge
As your data protection officer.
- 3
Validate your policy
It now has a Québec notice.
- 4
Publish your center
Québec appears in the form.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Does Law 25 apply to a company outside Québec?
Yes, when it collects or uses personal information of people in Québec in the course of business.
Who is the person in charge?
The person with the highest authority, unless they delegate the role in writing. Their title and contact must be on your website.
Are cookies allowed without consent in Québec?
Functions that identify, locate or profile must be ones the person activates. Privacyboard asks visitors in Québec first.
Can we extend the 30-day deadline?
Not on your own: a missed deadline counts as a refusal.
Official sources
- Act respecting the protection of personal information in the private sector (P-39.1)
- Commission d’accès à l’information, main changes of Law 25
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
