Quebec Law 25 Guide: Privacy Officer, Confidentiality Incidents, PIAs and Penalties

Quebec's Law 25 gives the province the strictest private sector privacy regime in Canada, with mandatory incident registers, privacy impact assessments before any transfer outside Quebec, and penalties of up to $25 million or 4% of worldwide turnover. Law 25 is the Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25, formerly Bill 64). It rewrote the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), the main subject of this guide, and also amended the public sector access act. This guide covers who is in scope, the obligations section by section, the confidentiality incident regime, the phased commencement, enforcement by the Commission d'accès à l'information (CAI), and what it means for automated decisions and machine access to personal data. It is for privacy officers, security leads and identity teams at organisations doing business in Quebec, including those headquartered elsewhere. For federal law see the Canada PIPEDA and Bill C-27 Guide.

Status checked 27 October 2026: all three phases of Law 25 are in force. The privacy officer and confidentiality incident duties began on 22 September 2022, most obligations and the new penalty regime on 22 September 2023, and data portability on 22 September 2024. The Regulation respecting confidentiality incidents has applied since 29 December 2022. Check the consolidated text on LégisQuébec for later amendments.

Key takeaways

• The top executive is the default privacy officer: section 3.1 makes the person with the highest authority responsible for protecting personal information unless the role is delegated in writing, and the title and contact details must be published on the website.
• Every incident goes in the register: section 3.8 requires a register of all confidentiality incidents, not only notifiable ones, kept for at least five years and sent to the CAI on request.
• Risk of serious injury triggers notice: the CAI and affected persons must be notified promptly when an incident presents a risk of serious injury, judged on sensitivity, anticipated consequences and likelihood of misuse (sections 3.5 and 3.7).
• PIAs are mandatory in two common cases: any project to acquire, develop or overhaul an information system or electronic service involving personal information, and any communication of personal information outside Quebec (sections 3.3 and 17).
• Penalties are GDPR-scale: administrative penalties up to $10 million or 2% of worldwide turnover, penal fines up to $25 million or 4%, and punitive damages of at least $1,000 for intentional or grossly negligent infringements.

Scope: who and what is covered

• Enterprises: the private sector Act applies to any person carrying on an enterprise that collects, holds, uses or communicates personal information about individuals in Quebec. Location of the head office does not matter; an out-of-province company serving Quebec residents is in scope for that information.
• Personal information: any information that relates to a natural person and allows that person to be identified, directly or indirectly.
• Public bodies: Law 25 made parallel changes to the Act respecting access to documents held by public bodies and the protection of personal information (CQLR c. A-2.1). This guide focuses on the private sector Act.
• Relationship with PIPEDA: Quebec's private sector Act is recognised as substantially similar to PIPEDA, so it generally governs intra-provincial processing, while PIPEDA still applies to cross-border and inter-provincial commercial transfers and to federally regulated sectors.

Key obligations

The confidentiality incident regime

• Definition (s 3.6): unauthorised access to, use of or communication of personal information, its loss, or any other breach of its protection. A misdirected email, an over-permissioned service account reading records it should not, and ransomware exfiltration all qualify.
• First duty (s 3.5): when there is cause to believe an incident has occurred, take reasonable measures to reduce the risk of injury and prevent recurrence.
• Risk assessment (s 3.7): consider the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used injuriously, and consult the privacy officer.
• Notification (s 3.5): if there is a risk of serious injury, promptly notify the CAI and any person whose information is concerned. The CAI can order notification. Notice to individuals may be delayed if it could hamper a criminal investigation. The Act gives no fixed hour count; "promptly" is the test.
• Regulation respecting confidentiality incidents: made by Décret 1761-2022 and in force since 29 December 2022, it prescribes the content of the notice to the CAI and to individuals, when a public notice may be used, and the content of the register. Information that becomes known after the first notice must be sent to the CAI with diligence.
• Register (s 3.8): record every incident, including those with no risk of serious injury, and keep each entry for at least five years from when you became aware of it.

Consent and secondary use

• Quality of consent (s 14): consent must be manifest, free and enlightened, given for specific purposes, and requested for each purpose in clear and simple terms, separately from other information. Sensitive personal information needs express consent. For a minor under 14, consent comes from the person having parental authority or the tutor.
• Use without consent (s 12): new exceptions allow use for purposes consistent with the original purpose, for the clear benefit of the person, to prevent and detect fraud, or to evaluate and improve protection and security measures. Security analytics on access logs can often rely on the last of these, but document the reasoning.
• Commercial transactions (s 18.4): personal information may be shared without consent when necessary to conclude a commercial transaction such as a merger, under a written agreement limiting use.

Decision guidance: small and large organisations

• Small enterprises: the obligations are the same, but the PIA can be proportionate to sensitivity, quantity and distribution (s 3.3). A one-page PIA template, a spreadsheet register and a delegated privacy officer are usually enough.
• Large and multi-province groups: run Law 25 as the baseline for Canadian personal information, because its register, PIA and default-privacy duties are stricter than PIPEDA's; deviations for other provinces then become exceptions rather than separate programmes.

Law 25 compared with PIPEDA and GDPR

For a wider comparison see the Breach Notification Laws by Country Guide.

Timeline and current status

1. 22 September 2021: Law 25 assented to.
2. 22 September 2022: privacy officer (s 3.1), confidentiality incidents (ss 3.5 to 3.8), communications in commercial transactions (s 18.4) and for research (ss 21 to 21.0.2).
3. 29 December 2022: Regulation respecting confidentiality incidents in force.
4. 11 May 2023: CAI publishes its general framework for monetary administrative penalties.
5. 22 September 2023: main phase, including governance policies, PIAs, transparency, consent, confidentiality by default, automated decisions, transfers outside Quebec, retention and destruction, de-indexing, and penalties (ss 90.1 to 93.1).
6. 22 September 2024: data portability (s 27, third paragraph).

Enforcement and penalties

The CAI's framework lists the factors it weighs: nature, seriousness, repetition and duration of the breach; sensitivity of the information; number of people affected; remedial measures; and cooperation. It favours penal proceedings for serious, intentional or repeated breaches and for obstruction.

What it means for AI agents and non-human identities

• Agent decisions fall under section 12.1: if an AI agent or model makes a decision about a person exclusively by automated processing, you must tell the person, explain the main factors and parameters on request, and route observations to a staff member who can review. Keep the decision inputs and model version so the explanation can be produced. See the AI Agent Audit Trails for Regulators Guide.
• Machine access is a common incident cause: a service account, API key or agent token that reads personal information beyond its purpose is "unauthorised access" under section 3.6, even if no outsider was involved. Least privilege for machine identities directly reduces register entries. See the Service Account Security Guide.
• The risk assessment needs identity evidence: whether misuse is likely depends on who held the credential. Logs that tie access to a named workload identity let you show a contained, low-risk incident; without them you may have to assume the worst.
• Cloud and AI providers outside Quebec need a PIA: sending personal information to a model API or SaaS tool hosted elsewhere is a communication outside Quebec under section 17. Do the PIA before connecting the integration and put protection measures in the written agreement. See the Third-Party AI Risk Guide.
• Anonymised training data must stay anonymous: section 23 requires irreversible anonymisation to best practices; re-identification risk from model outputs should be part of the assessment.

Framework mapping

Compliance steps

1. Confirm the privacy officer: record a written delegation if the highest authority is not acting, and publish title and contact details.
2. Stand up the incident register: fields for date of awareness, description, information concerned, number of people, risk assessment outcome, notices sent and measures taken; retain entries for five years. Use it for every security event involving personal information.
3. Write the serious injury test into the runbook: sensitivity, consequences and likelihood, with the privacy officer consulted and the decision recorded.
4. Build a PIA trigger into change management: any new system, major overhaul or new provider outside Quebec opens a PIA before contract signature.
5. Inventory exclusively automated decisions: include AI agents and scoring tools; prepare notices and a human review route.
6. Set privacy by default: review product settings so the most protective option is the default.
7. Test portability: confirm you can export information a person provided in a structured, commonly used format.
8. Exercise and review: run a tabletop on a service account leak; check the register entry, the risk decision and the notice timing; review policies yearly.

Detection and measurement

• Register completeness: security incidents involving personal information that have a register entry, target 100%.
• Time to risk decision: median time from awareness to documented serious injury assessment.
• PIA coverage: percentage of new systems and transfers outside Quebec with a completed PIA before go-live.
• Automated decision readiness: percentage of automated decision systems with a notice and a tested review route.
• Machine identity hygiene: percentage of service accounts and agents with access to personal information that have an owner and scoped permissions.

Common failure patterns

• Registering only notifiable incidents: the register covers all confidentiality incidents.
• Skipping the transfer PIA: signing with a US or European SaaS or AI provider without the section 17 assessment.
• Undocumented delegation: no written record of who is the person in charge.
• Treating internal over-access as harmless: unauthorised use by an over-permissioned integration is still an incident.
• Pseudonymisation mistaken for anonymisation: keeping a re-identification key while claiming section 23 anonymisation.

Practitioner checklist

• Publish the privacy officer's title and contact details.
• Keep a register of every confidentiality incident for at least five years.
• Document each serious injury assessment with the privacy officer's input.
• Run a PIA for every information system project and every transfer outside Quebec.
• Put written protection clauses in all service provider contracts.
• Give notice and a human review route for exclusively automated decisions.
• Set the most protective privacy settings by default.
• Scope and own every machine identity that reads personal information.
• Test data portability exports.

Standards and references

• LégisQuébec: Act respecting the protection of personal information in the private sector (CQLR c. P-39.1)
• LégisQuébec: Act respecting the protection of personal information in the private sector, PDF consolidation
• Commissaire à la santé et au bien-être: Cadre de gestion des incidents de confidentialité
• BLG: Quebec Bill 64 Guide
• Osler: Law 25, a new enforcement scheme
• NIST: SP 800-53 Rev. 5

This guide summarises Quebec's Law 25 and the Act respecting the protection of personal information in the private sector as of 27 October 2026 and is not legal advice. Related NHI Mgmt Group resources: Canada PIPEDA and Bill C-27 Guide · DPIA Guide: Running a Data Protection Impact Assessment · Breach Notification Laws by Country Guide · Canada AI Regulation Guide (post-AIDA)