Who Is Covered by Law 25?

For nearly 30 years, personal information protection in Quebec's private sector rested on a law passed in 1994 — an era without smartphones, cloud computing or artificial intelligence. Massive data breaches, the monetization of personal data and the sheer pervasiveness of digital life made that framework obsolete.

Law 25 — passed on September 21, 2021 under the official title Act to modernize legislative provisions as regards the protection of personal information — primarily modernizes the Act respecting the protection of personal information in the private sector. It draws heavily on the European GDPR, making Quebec one of the strictest jurisdictions in North America.

1. Hold organizations accountable. Businesses can no longer treat personal data as a free resource. They must formally answer for it.
2. Give control back to citizens. New rights let individuals know, correct, retrieve and, in some cases, have their information deleted.
3. Deter through real sanctions. Fines that can reach millions of dollars give the law real teeth (see chapter 14).

Law 25 applies to every business that carries on an activity in Quebec and collects, holds, uses or discloses personal information — regardless of size. This includes:

• SMBs and manufacturers in every sector
• Self-employed workers and professionals (notaries, accountants, brokers, clinics…)
• Nonprofit organizations that operate an "enterprise" within the meaning of the Civil Code
• Retailers, manufacturers, agencies, consulting firms

PIPEDA (the federal law) applies notably to interprovincial and international commercial activities. Since Quebec has adopted its own law, Law 25 generally takes precedence for activities that stay within Quebec. For businesses operating internationally, both regimes can apply simultaneously.