Quebec Law 25, amending the Act respecting the protection of personal information in the private sector (P-39.1)
Anyone carrying on an enterprise in Quebec who collects, holds, uses or communicates other people's personal information, whether directly or through a third party.
This is general information, not legal advice.
Status: In force; the official Légis Québec text opened is current to October 15, 2026.
What to check
- When a decision is based exclusively on automated processing of personal information, tell the person no later than when you tell them the decision. Source
- On request, explain the personal information used, the reasons and main factors and parameters behind an automated decision, and the right to have the information corrected. Source
- Give the person a chance to submit observations to a staff member able to review the automated decision. Source
- Do a privacy impact assessment for any project to acquire, develop or overhaul a system that handles personal information, consulting your privacy lead from the outset. Source
- Before sending personal information outside Quebec, or entrusting it to someone there, do a privacy impact assessment and put a written agreement in place if protection is adequate. Source
- Tell people first if you collect their information using technology that can identify, locate or profile them, and how to turn those functions on. Source
- Publish your privacy lead's title and contact details, and clear information on your governance policies and practices. Source
- Notify the regulator and affected people promptly of a confidentiality incident presenting a risk of serious injury, and keep a register of incidents. Source
- Get express consent to use or communicate sensitive information such as medical or biometric data. Source
Penalties
Administrative monetary penalties of up to 2% of worldwide turnover or $10 million; penal fines for businesses from $15,000 to the greater of $25 million or 4% of worldwide turnover, doubled for repeat offences.