Topic starter
11/07/2026 8:23 pm
TL;DR: Quebec’s Law 25 expands breach notification, privacy impact assessments, enhanced consent, and subject rights obligations for organisations handling personal information of Quebec residents, with penalties reaching 4% of worldwide turnover, according to OneTrust. The practical issue is not just legal scope but whether privacy, security, and identity workflows can prove control across collection, sharing, retention, and incident response.
Editorial analysis by NHI Mgmt Group, based on content published by OneTrust: “Quebec’s Law 25: What Is It and What Do You Need to Know?”.
By the numbers:
- Law 25 introduced a three-year entry-into-effect period, with the majority of provisions entering into effect in September 2023.
Key questions
Q: How should organisations prepare for Quebec's Law 25 across privacy governance, impact assessments, and breach response?
A: Organisations should treat Law 25 as a programme change, not a policy update.
Q: Why do privacy impact assessments matter for identity and data workflows?
A: PIAs force teams to examine where personal information moves, who can access it, whether it leaves the jurisdiction, and what safeguards apply.
Q: What breaks when data subject rights requests are handled manually at scale?
A: Manual handling breaks under volume, deadlines and data sprawl.
Practitioner guidance
- Map law 25 obligations to system owners Assign each obligation to the business system, data flow, and team that can actually evidence it, including consent, access, deletion, retention, and breach handling.
- Trigger PIAs in change management Require a privacy impact assessment before new systems, service changes, or cross-border transfers can proceed when personal information is involved.
- Synchronise rights workflows with identity and data inventories Make sure access, erasure, portability, and correction requests can be executed across connected platforms, not just in the front-end privacy portal.
Bottom line: Law 25 makes privacy governance measurable by tying obligations to accountability, PIAs, consent handling, breach records, and subject rights workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:53 pm
Law 25 is a governance enforcement mechanism, not just a privacy statute. Its practical effect is to force organisations to connect legal obligations to real operating controls across data handling, incident response, and rights management. That is especially relevant where privacy programmes depend on identity, access, and service-provider workflows to prove who can touch personal information and why. Practitioners should treat it as a control design problem, not a legal interpretation problem.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should privacy teams and security teams align on for Law 25 compliance?
A: They should align on data inventories, notification triggers, retention rules, and the controls that prove who accessed personal information and when. The law is not satisfied by a policy alone, because operational evidence comes from access logs, workflow records, and incident registers that both teams can trust.
👉 Read our full editorial: Quebec’s Law 25 raises the bar for privacy governance and controls