Quebec Law 25

Modernization of privacy legislation with biometric data protections and privacy by default requirements.

Analysis

Appointment of a Privacy Officer Every organization must designate the highest authority (or a delegate) as responsible for personal information protection. The contact information of this officer must be publicly available, typically on the organization's website. Commission d’accès à l’information du Québec (CAI) Official Text CookieYes Law 25 Guide CFIB Law 25 Overview

Governance Policies & Practices Organizations must establish, implement, and publish governance policies regarding personal information protection, including data retention periods, roles and responsibilities, and complaint handling. CAI Official Text Terranova Security Law 25 Guide CookieYes Law 25 Guide

Privacy Impact Assessments (PIA) Mandatory PIAs for any new or modified project, technology, or system involving personal information, including transfers outside Quebec and automated decision-making. BigID Law 25 Requirements SecurePrivacy Law 25 Guide CAI Official Text

Consent Requirements Explicit, informed, and granular consent is required before collecting, using, or disclosing personal information, especially sensitive or biometric data. SecurePrivacy Law 25 Guide BigID Law 25 Requirements CookieYes Law 25 Guide

Data Subject Rights Individuals have rights to access, rectify, erase, restrict processing, withdraw consent, data portability (from September 2024), and object to automated decision-making. SecurePrivacy Law 25 Guide BigID Law 25 Requirements CAI Official Text

Breach Notification Organizations must notify affected individuals and the CAI of any data breach likely to cause serious harm. Outside GC Law 25 Summary CookieYes Law 25 Guide

Confidentiality by Default Systems must use the highest privacy settings by default, requiring no action from the user. SecurePrivacy Law 25 Guide CAI Official Text

Complexity of Data Mapping and Governance Many organizations struggle to identify all personal data flows and maintain up-to-date governance policies, especially SMEs. CFIB Law 25 Overview Terranova Security Law 25 Guide

Conducting Privacy Impact Assessments Organizations often lack resources or expertise to conduct thorough PIAs for every new project or technology. BigID Law 25 Requirements SecurePrivacy Law 25 Guide

Obtaining and Managing Consent Ensuring consent is explicit, informed, and granular for all purposes is challenging, especially for legacy systems and multi-channel data collection. CookieYes Law 25 Guide SecurePrivacy Law 25 Guide

Responding to Data Subject Requests Organizations must respond to requests within 30 days, which can be difficult without automated workflows. BigID Law 25 Requirements SecurePrivacy Law 25 Guide

Real Example: According to the CFIB, small businesses report confusion over privacy officer designation and the scope of required policies.

Appoint a Qualified Privacy Officer Assign responsibility to a senior leader with privacy expertise and publish their contact information. CAI Official Text CFIB Law 25 Overview

Develop and Publish Governance Policies Create clear, accessible privacy policies covering data retention, roles, and complaint handling. Terranova Security Law 25 Guide CookieYes Law 25 Guide

Implement Privacy Impact Assessment Workflows Use standardized templates and tools for PIAs, and integrate assessments into project management processes. BigID Law 25 Requirements SecurePrivacy Law 25 Guide

Automate Consent Management Deploy consent management platforms to capture, store, and manage user consents. CookieYes Law 25 Guide SecurePrivacy Law 25 Guide

Full Implementation Date: Most provisions became effective on September 22, 2023. CookieYes Law 25 Guide CAI Official Text

Data Portability Right: The right to data portability will become enforceable in September 2024. SecurePrivacy Law 25 Guide BigID Law 25 Requirements

Recent Amendments: The law was originally passed as Bill 64 in September 2021, with phased implementation over three years. CAI Official Text CookieYes Law 25 Guide

PIPEDA (Personal Information Protection and Electronic Documents Act) Federal privacy law for private-sector organizations in Canada; Law 25 provides additional rights and stricter requirements for Quebec residents. Office of the Privacy Commissioner of Canada – PIPEDA Terranova Security Law 25 Guide

GDPR (General Data Protection Regulation) Law 25 aligns with GDPR principles, including data subject rights, PIAs, and privacy by default. European Commission GDPR Portal SecurePrivacy Law 25 Guide

Other Canadian Provincial Laws Alberta, British Columbia, and Ontario have their own privacy laws, but Law 25 is currently the most stringent in Canada. Office of the Privacy Commissioner of Canada – Provincial Laws BigID Law 25 Requirements

Technology & SaaS Companies must redesign systems for privacy by default and implement robust consent management, impacting product development cycles. BigID Law 25 Requirements SecurePrivacy Law 25 Guide

Retail & E-commerce Enhanced consent and breach notification requirements increase operational complexity and compliance costs. CookieYes Law 25 Guide CFIB Law 25 Overview

Healthcare & Biometric Data Stricter rules for biometric and sensitive data require advanced security controls and frequent PIAs. SecurePrivacy Law 25 Guide CAI Official Text

Small Businesses Many SMEs report difficulty understanding and implementing requirements, especially around privacy officer designation and policy publication. CFIB Law 25 Overview Terranova Security Law 25 Guide

2025-11-13 — Overview for 2025 stressing that Law 25 applies to all businesses in Quebec and outlining upcoming 2025 expectations for PIAs before sensitive-data collection/sharing, management of cross‑border transfers with documented safeguards, data portability, right to erasure, and fully documented internal privacy practices.[5] (source)
2025-10-28 — 2025-focused guide explaining Loi 25 obligations now that the law is effectively mature, highlighting enforcement risk, the need for ongoing PIAs, vendor and cross‑border data controls, and operational impacts on security, HR, and marketing programs.[10] (source)