Why Law 25?
Law 25 is the common name of the Act to modernize legislative provisions as regards the protection of personal information (assented to in September 2021, previously "Bill 64"). It updates Québec's privacy laws for the digital age: cloud computing, big data, artificial intelligence, profiling.
What it changes
- More transparency: people know what information is collected, why and by whom.
- More control: stricter consent, and rights of access, rectification, withdrawal and portability.
- More accountability: internal governance, risk assessments (PIAs, called EFVP in French), incident management.
- Real penalties: up to $10M or 2 % of worldwide turnover (administrative) and $25M or 4 % (penal).
Who it applies to
| Type of organization | Main law |
|---|---|
| Private enterprises in Québec (SMBs, software vendors, private schools) | Act respecting the protection of personal information in the private sector (the "Private Sector Act") |
| Public bodies (departments, municipalities, school service centres and public schools) | Act respecting access to documents held by public bodies and the protection of personal information (the "Access Act") |
This training mostly covers the private sector; public-sector specifics are flagged in the school pages.
Example (SaaS). A B2B software vendor based in Montréal is a covered enterprise, both for its employees' and prospects' information and for what its business customers store in its product.
Example (school). A private school collects records on minor students: it must protect them like any enterprise. A public school service centre falls under the Access Act instead.
Learn more
Commission d'accès à l'information (CAI): https://www.cai.gouv.qc.ca/. See also the legal disclaimer.
Detailed legal framework: see the reference guide — Who is covered by Law 25?.