CHAPTER 2
Timeline of Coming Into Force (2022–2024)
Law 25 did not come into force all at once. Three phases spread over three years. As of 2026, everything is in force. There is no more transitional period.
Phase 1 · September 22, 2022
Governance and incidents — the foundations
- Mandatory designation of a Privacy Officer. By default, the person with the highest authority (CEO) assumes this role, unless delegated in writing. → Chapter 5
- Obligation to manage confidentiality incidents: keep a register, notify the CAI and affected individuals when there is a risk of serious harm. → Chapter 7
- New rules for commercial transactions (mergers, business sales) involving personal data.
Phase 2 · September 22, 2023
Policies, consent, transparency — the densest phase
This is the phase that affects an SMB's day-to-day the most. It introduces:
- A governance policy covering retention, destruction and internal roles
- A published privacy policy in plain language (on the website)
- New consent rules: clear, freely given, informed, for specific purposes, requested separately
- Transparency at collection: inform the individual of purposes, means, rights, and disclosure outside Quebec
- Mandatory PIA for new systems and disclosures outside Quebec. → Chapter 6
- Privacy settings set to maximum by default (privacy by default)
- Administrative monetary penalties (AMPs) in force. → Chapter 14
Phase 3 · September 22, 2024
Portability, de-indexing — full application
- Right to data portability: disclose the computerized information provided by the individual, in a structured, commonly used format. → Chapter 8
- Right to de-indexing / cessation of dissemination (Quebec's equivalent of the "right to be forgotten")
- Full application of all provisions
Summary table
Overview of the 3 phases
| Phase | Date | Main obligations |
|---|---|---|
| Phase 1 | Sept. 22, 2022 | Privacy Officer, incident register, incident management, commercial transactions |
| Phase 2 | Sept. 22, 2023 | Policies, consent, collection transparency, PIA, AMPs, privacy by default |
| Phase 3 | Sept. 22, 2024 | Data portability, de-indexing, full application |
As of 2026, everything is in force. There is no more transitional period. Every unmet obligation is potentially subject to sanction.
✓ Timeline checklist
- ☐ Do our policies (governance + privacy) exist and have they been up to date since Sept. 2023?
- ☐ Has our incident register been in place since Sept. 2022?
- ☐ Can we respond to a portability or de-indexing request (as of Sept. 2024)?