Quebec’s Law 25 raises the bar for privacy governance and controls

At a glance

What this is: Quebec’s Law 25 is a privacy law overhaul that broadens organisational duties across breach notification, privacy impact assessments, consent, subject rights, and accountability.

Why it matters: It matters because privacy teams, security teams, and identity workflows now have to demonstrate control over personal information handling, not just document policies after the fact.

By the numbers:

• Law 25 introduced a three-year entry-into-effect period, with the majority of provisions entering into effect in September 2023.
• Privacy officers must respond to subject rights requests within 30 days of receipt, with the possibility of an extension.

Context

Quebec’s Law 25 is best understood as a governance overhaul, not a narrow privacy update. It expands duties around breach notification, privacy impact assessments, consent, rights handling, and designated accountability for organisations that process personal information about Quebec residents, including some out-of-province entities.

For IAM, IGA, and security teams, the practical shift is that identity-adjacent processes now sit inside a regulated privacy lifecycle. Access to personal data, retention limits, third-party sharing, and incident response all need controls that can be evidenced, not just described. That is typical of modern privacy regulation, but Law 25 makes the operating model harder to treat as paperwork.

The law also creates a stronger need to align legal obligations with technical workflows, especially where systems profile individuals, automate decisions, or transfer personal information outside Quebec.

Key questions

Q: How should organisations prepare for Quebec's Law 25 across privacy governance, impact assessments, and breach response?

A: Organisations should treat Law 25 as a programme change, not a policy update. Start by mapping personal information flows, assigning a privacy officer, and identifying where privacy impact assessments are required. Then update breach notification procedures, consent language, retention practices, and contracts with service providers. The goal is a documented, repeatable control set that supports transparency, accountability, and timely compliance across the transition period.

Q: Why do privacy impact assessments matter for identity and data workflows?

A: PIAs force teams to examine where personal information moves, who can access it, whether it leaves the jurisdiction, and what safeguards apply. In practice, that makes PIAs a control point for identity governance because access, sharing, and deletion decisions often determine whether the organisation can satisfy privacy obligations.

Q: What breaks when data subject rights requests are handled manually at scale?

A: Manual handling breaks under volume, deadlines and data sprawl. Teams struggle to verify identity, search every connected system, and coordinate corrections or deletion consistently. That creates late responses, incomplete results and poor auditability, especially when requests must be resolved across cloud apps, databases and collaboration tools.

Q: What should privacy teams and security teams align on for Law 25 compliance?

A: They should align on data inventories, notification triggers, retention rules, and the controls that prove who accessed personal information and when. The law is not satisfied by a policy alone, because operational evidence comes from access logs, workflow records, and incident registers that both teams can trust.

Technical breakdown

How Law 25 turns privacy governance into a control problem

Law 25 moves privacy from policy intent into operational control. It requires organisations to show who is accountable, what data is being processed, why it is processed, how long it is retained, and what happens when rights requests or incidents occur. That creates a governance chain spanning privacy, security, identity, procurement, and legal teams. The important technical issue is not just whether a policy exists, but whether systems, logs, contracts, and workflows can prove compliance across the data lifecycle.

Practical implication: Map privacy obligations to the systems and workflows that actually collect, store, share, and delete personal information.

Why PIAs and breach records matter for personal information flows

Privacy impact assessments are not a paperwork exercise when systems are being built or changed. Under Law 25, PIAs are required in specific circumstances, including activities involving sharing outside Quebec, and they must consider sensitivity, purpose, protective measures, and the legal framework in the destination jurisdiction. Separately, breach records create an audit trail for security incidents and support accountability when personal information may have been exposed.

Practical implication: Build PIA triggers and incident registers into change management so new systems cannot bypass privacy review.

How consent and subject rights intersect with identity workflows

Law 25’s consent and subject rights provisions create a direct bridge between privacy governance and identity operations. Organisations must present consent clearly, separately, and for specific purposes, then honour withdrawal, access, erasure, restriction, portability, and rectification requests on deadline. That means identity, customer data, and case-management processes need coordinated ownership, because rights requests often depend on locating data across systems and service providers.

Practical implication: Align access, deletion, and portability workflows with identity and data inventories so rights requests can be fulfilled consistently.

NHI Mgmt Group analysis

Law 25 is a governance enforcement mechanism, not just a privacy statute. Its practical effect is to force organisations to connect legal obligations to real operating controls across data handling, incident response, and rights management. That is especially relevant where privacy programmes depend on identity, access, and service-provider workflows to prove who can touch personal information and why. Practitioners should treat it as a control design problem, not a legal interpretation problem.

Quebec’s privacy model exposes the weakness of policy-only compliance. A privacy policy can describe consent, retention, and breach handling, but it cannot evidence them. Law 25 makes that gap visible because organisations must show operational readiness for PIAs, notices, records, and subject rights handling. Practitioners should assume that any disconnected workflow between legal, privacy, IAM, and security will become a compliance bottleneck.

Privacy programmes now need identity-aware data governance. When an organisation can profile individuals, share data outside the province, or process rights requests only through manual effort, the privacy lifecycle becomes brittle. The named concept here is privacy control traceability: the ability to connect each obligation to a system, owner, record, and workflow. Practitioners should build that traceability before regulators or customers ask for evidence.

Law 25 raises the cost of fragmented ownership. The law explicitly assumes someone can be designated responsible, but the real issue is whether that person can coordinate with the teams that own collection, storage, sharing, and deletion. Where privacy, security, and identity teams operate separately, the organisation will struggle to keep the control model coherent. Practitioners should use the law to force cross-functional accountability, not just assign a title.

The regulation validates privacy operationalisation as a security discipline. Breach notification, consent handling, and retention limits all depend on auditable controls, not static documentation. That makes the article a strong signal that privacy governance is converging with broader security governance, especially where personal information flows through cloud services, SaaS, and managed identity paths. Practitioners should prepare for evidence-driven audits rather than narrative-only compliance reviews.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: IGA Buyer's Guide

What this signals

Privacy control traceability: Law 25 pushes organisations toward a model where each legal duty must map to an owner, record, and workflow. That changes privacy from a documentation exercise into an evidence discipline, especially when rights requests and incident reporting depend on connected systems across legal, security, and identity functions.

The strongest operational risk is fragmentation between privacy policy, technical access control, and incident response. If retention, sharing, and deletion are governed in separate tools or teams, the organisation will struggle to prove compliance when a regulator or customer asks for a complete account.

Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey. That gap is a useful signal for privacy teams too: governance intent is not the same as operational control, and the same weakness appears in privacy programmes that rely on manual coordination.

For practitioners

• Map law 25 obligations to system owners Assign each obligation to the business system, data flow, and team that can actually evidence it, including consent, access, deletion, retention, and breach handling.
• Trigger PIAs in change management Require a privacy impact assessment before new systems, service changes, or cross-border transfers can proceed when personal information is involved.
• Synchronise rights workflows with identity and data inventories Make sure access, erasure, portability, and correction requests can be executed across connected platforms, not just in the front-end privacy portal.
• Document breach records and notification decisioning Keep a structured record of security incidents, the legal trigger used, and the notification outcome so the organisation can defend its response later.

Key takeaways

• Law 25 makes privacy governance measurable by tying obligations to accountability, PIAs, consent handling, breach records, and subject rights workflows.
• The law’s practical burden is operational, because privacy teams must evidence who accessed personal information, why it was collected, and how requests are fulfilled.
• Organisations that cannot connect legal requirements to system-level controls will struggle to defend compliance across collection, sharing, retention, and incident response.

Key terms

• Privacy Impact Assessment: A privacy impact assessment is a structured review of how a system, process, or change affects personal data and individual rights. The strongest versions are based on live system evidence, not questionnaire answers, and they create a clear approval trail.
• Subject Rights Request: A Subject Rights Request is a formal request from an individual to access, correct, erase, restrict, or otherwise control their personal information. In operational terms, it becomes a workflow problem across data discovery, identity matching, records handling, and evidence retention.
• Privacy Office: A privacy office is the internal function that sets privacy guidelines, coordinates stakeholders, and oversees how personal data is governed across the organisation. In practice, it connects legal, compliance, technology, and business teams so privacy decisions are consistent, documented, and enforceable across products, partners, and jurisdictions.
• Cross Border Data Transfer: The movement of personal data from one jurisdiction to another, often across different privacy and surveillance regimes. In GDPR terms, the transfer may be regulated even when it occurs through analytics tags, cookies, or service providers, because the relevant issue is where data can be accessed and processed.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and secrets management in a way that helps security and identity practitioners connect control design to operational evidence. Explore it when your programme needs a stronger bridge between identity governance and the wider security controls that support it.