You hear about Law 25 from a customer, an accountant or a cookie banner. Each one describes a different part of it. This article puts the parts together: what the law is, who it covers, what it asks for and how a small business can approach it.
What Law 25 is
Law 25 is the common name of Bill 64, An Act to modernize legislative provisions as regards the protection of personal information. Québec passed it in September 2021 as chapter 25 of that year’s statutes. It amended the Act respecting the protection of personal information in the private sector (CQLR c P-39.1), which already applied to businesses in Québec.
Think of a building code update. The building stays the same, but new rules say where the smoke alarms go and who checks them. Law 25 does the same for personal information. Personal information is any information about a person that allows you to identify them, directly or indirectly. A name, an email address and a pay slip are examples.
Why it matters for an SMB
The private-sector Act covers personal information that a person collects, holds, uses or communicates while carrying on an enterprise. In practice, it applies to most organizations that operate in Québec. The law sets no minimum size. Some duties scale, though: your governance policies must be proportionate to the nature and scope of your activities.
PIPEDA, the federal private-sector privacy law, still applies in Québec to federally regulated businesses, such as banks. It also applies to personal information that crosses provincial or national borders.
The rules came into force in three phases:
- September 22, 2022: the person in charge of the protection of personal information, the register of confidentiality incidents, and notice of serious incidents.
- September 22, 2023: most of the other rules, including governance policies, privacy impact assessments, consent, transparency, de-indexation, communication outside Québec and the new penalties.
- September 22, 2024: the right to data portability.
The penalties are large. The Commission d’accès à l’information (CAI), the Québec regulator, can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Penal fines for a business range from $15,000 to $25 million, or 4% of worldwide turnover if that is greater. The fines double for a subsequent offence. A court must also award punitive damages of at least $1,000 when an infringement is intentional or results from a gross fault.
What it asks for
The duties fall into seven groups.
A person in charge
The person with the highest authority in the business, often the CEO, is the person in charge of the protection of personal information. That person can delegate all or part of the role in writing. You publish the title and contact information on your website.
Governance policies and a privacy policy
You set governance policies and practices for personal information. They cover how you keep and destroy the information, who does what with it, and how you handle complaints. The person in charge approves them. You publish detailed information about them on your website, in simple and clear language. If you collect personal information through technological means, such as a website or an app, you also publish a confidentiality policy.
Transparency and consent
When you collect personal information, you tell the person why and how you collect it, and what rights they have. Collect only the information you need for the purposes you set. Consent must be clear, free and informed, and given for specific purposes. Sensitive information, such as health or biometric data, needs express consent. A product or service you offer to the public must use its most private settings by default, except for browser cookies.
Privacy impact assessments
A privacy impact assessment (EFVP, évaluation des facteurs relatifs à la vie privée) reviews the privacy risks of a project. You need one for any project to acquire, develop or overhaul an information system or an electronic service that involves personal information. Consult the person in charge from the start of the project.
Communication outside Québec
Before personal information leaves Québec, you complete a privacy impact assessment. It looks at the sensitivity of the information, its purpose, the protection measures and the laws of the destination. You send the information only if it gets adequate protection, under a written agreement. The same rule applies when a provider outside Québec collects, uses or keeps the information for you.
Confidentiality incidents
A confidentiality incident is access, use or communication of personal information that the law does not authorize, or its loss. When you suspect one, take reasonable steps to reduce the risk of injury. Record every incident in a register, whatever its severity. If the incident presents a risk of serious injury, notify the CAI and the people concerned promptly. The CAI can ask for a copy of the register.
Rights of the people concerned
People can ask to access their personal information and to correct it. Since September 2024, they can also ask for a copy in a structured, commonly used technological format. In some cases, a person can ask you to stop spreading their information or to de-index a link to their name. You answer access and correction requests in writing, within 30 days. Our guide to data subject requests covers the steps.
How to approach it
Start with the duties that protect you the most, then build the rest on top.
- Name the person in charge, in writing if you delegate, and publish the title and contact information.
- Open the incident register now, before you need it. Agree who records an incident and who decides on notice.
- List the software and vendors that hold personal information, and note which ones keep it outside Québec.
- Run a privacy impact assessment for each new system and each transfer outside Québec. Keep the result with the contract.
- Write your governance policies and your privacy policy in plain language, then publish them.
- Prepare a process for access, correction and portability requests, so that you can answer within 30 days.
Our practical Law 25 checklist turns the core duties into five jobs with an owner and a piece of evidence each.
Common mistakes
- Assuming the law is only for large companies. It has no size threshold.
- Naming a person in charge but not publishing the title and contact information.
- Recording only the serious incidents. The register covers every incident.
- Forgetting that the same assessment applies to a cloud tool that keeps your data outside Québec.
- Treating Law 25 as a project that ends. Policies, assessments and the register need regular review.
Good to know: This article is general information, not legal advice. For your own obligations, speak with a qualified lawyer.
How NextIT helps
NextIT keeps the main Law 25 work in one place. The Security Incident Register records every incident and helps you draft a breach communication. In Privacy & Compliance, you run impact assessments and keep your record of processing activities. The privacy policy generator drafts a policy aimed at Law 25 from your company profile. The Privacy & Compliance guide and the incident management guide explain each part. To see how this fits your business, book a demo.