Quebec Law 25 — Modernised privacy regime for businesses
Bill 64 modernisation now in full effect — what every Quebec-facing business needs to know
Quebec Law 25 (officially the Act to modernise legislative provisions as regards the protection of personal information, formerly Bill 64) came into force in stages from September 2022 to September 2024. It significantly modernised Quebec's private-sector privacy regime, aligning it more closely with the GDPR. This guide covers consent requirements, data residency disclosure, breach notification, DPO designation and penalties.
Who is subject to Law 25
Any private-sector enterprise (corporation, partnership, sole proprietorship) collecting, using or disclosing personal information of Quebec residents. Applies regardless of where the enterprise is located — US, EU and other Canadian businesses with Quebec customers are also subject to it. There's no revenue or size threshold.
Express consent and purpose disclosure
Consent must be express (no pre-checked boxes), given freely, specific, informed, with clear purpose disclosure. Each new purpose requires fresh consent. Consent can be withdrawn at any time, business must process within a reasonable time. Privacy notices must be in clear language in French (Bill 96 also applies).
Cross-border data transfer disclosure
Significant change from previous regime: businesses must conduct a Privacy Impact Assessment for cross-border data transfers and ensure adequate protection. Customers must be informed of transfers outside Quebec, including to other Canadian provinces and Canadian data residency option may be required.
Privacy Officer (DPO equivalent) mandatory
All businesses subject to Law 25 must designate a Privacy Officer (person in charge of personal information protection). For most SMBs, this defaults to the highest-ranking executive unless someone else is explicitly designated. The Privacy Officer's identity must be published online.
Breach notification and penalties
Privacy breaches with risk of serious injury must be reported to Commission d'accès à l'information (CAI) and affected individuals 'with diligence'. Maximum fines: $25M or 4% of preceding year worldwide revenue (whichever is higher). Private right of action for individuals to sue.
How 4b2b helps
Frequently asked questions
Does Law 25 apply to me if I'm not in Quebec?
Yes if you have Quebec customers. The law applies based on the data subject's location, not the business's location.
What counts as 'express consent'?
No pre-checked boxes, clear purpose disclosure, freely given. The user must take an explicit affirmative action. Online: actual click on an unchecked consent checkbox.
Is Canadian data residency mandatory?
Not technically, but cross-border transfers require Privacy Impact Assessment + disclosure to customers + adequate protection contractually. Canadian residency simplifies compliance.
What about Bill 96 French requirements?
Bill 96 (separate, 2022) requires French. Privacy notices, consent forms, communications with Quebec customers must be in French. Some bilingual operations also accepted.
Penalties magnitude?
Up to $25M CAD or 4% of preceding year worldwide turnover, whichever is higher. Plus private right of action — individuals can sue for damages.
Related solutions & industries
Put this guide into practice with concrete 4b2b solutions and industry-specific examples.