Quebec Law 25 is the 2021 law that rewrote Quebec's privacy rules for businesses and public bodies. In practice it means a named person in charge of personal information, a plain-language privacy policy on your website, consent asked for each purpose, tracking and profiling features switched off by default, an assessment before data leaves Quebec, and reporting serious privacy incidents.
The changes came in stages from September 2022 to September 2024, so they're all in force now. The regulator is the Commission d'acces a l'information du Quebec (CAI), and it can now impose administrative monetary penalties on businesses.
What Law 25 asks a business to do
| Obligation | What the CAI says it means |
|---|---|
| Person in charge | The person with the highest authority in the business is responsible by default, and can delegate in writing |
| Publish who that is | Their title and contact details go on your website |
| Governance policies | Rules for keeping and destroying data, staff roles and a complaints process, published on your website |
| Privacy policy | Written in simple, clear terms if you collect data by technological means, and people told when it changes |
| Consent | Asked for each purpose, in simple terms, presented separately from other information |
| Privacy by default | Products and services offered to the public set to the highest level of confidentiality |
| Incidents | Notify the CAI and the people affected when there's a risk of serious harm, and keep an incident register |
| Data leaving Quebec | A privacy impact assessment first, and a written agreement |
The rules that change everyday marketing
Most of Law 25 reads like any privacy law. A few lines hit marketers directly.
- Tracking off by default. If you collect data using technology that can identify someone, locate them or build a profile of them, you must tell them first and tell them how to switch those functions on. The CAI says it plainly: these technologies can't be activated by default.
- Consent per purpose. Consent has to be asked for each purpose, separately from any other information, and data can't be reused for another purpose without fresh consent, with some exceptions. Sensitive information needs express consent before it's used for a different purpose.
- What you tell people at collection. The purposes, the means of collection, their rights of access and correction, their right to withdraw consent, and whether the data may go outside Quebec.
- Automated decisions. If a decision is based only on automated processing, you must tell the person and let them put their view to a member of staff who can review it.
- Children under 14. You can't collect personal information from a minor under 14 without consent from a parent or guardian, unless it's clearly for the child's benefit.
The catch: cookies are treated differently
Here's a detail that's easy to misread. The privacy-by-default rule, the highest confidentiality settings with no action from the user, doesn't apply to the privacy settings of a cookie. That doesn't mean cookies are a free pass: if a cookie or pixel is used to identify, locate or profile people, the separate rule about those technologies still applies. Check your analytics, ad pixels and chat widgets against that rule, not just your cookie banner.
Sending data outside Quebec
Since September 2023, before you communicate personal information outside Quebec, you have to carry out a privacy impact assessment. The transfer can go ahead if the assessment shows the information would get adequate protection, and it has to be covered by a written agreement. For a small business, that's the line that touches every email platform, CRM or cloud tool hosted elsewhere. The assessment should be proportionate to how sensitive the data is, how much there is and what it's used for.
People's rights under Law 25
- Portability. Since 22 September 2024, on request, you must give a person the computerised personal information collected from them in a structured, commonly used format.
- De-indexing. People can ask a business to stop publishing their personal information, or to de-index a link to their name, if it harms them or breaks the law.
- Access on request. Which data you hold, which staff can see it, how long you keep it, and who to contact.
Penalties and enforcement
The CAI can impose administrative monetary penalties on businesses that break the private sector law. As of October 2026, its guidance gives the example that these could reach 2% of worldwide turnover or $10 million. A business can also give the CAI an undertaking to fix the problem; if the CAI approves it and it's kept, no penalty follows for the acts it covered. The CAI can also bring penal proceedings and order notices to the people affected after an incident.
A Law 25 checklist for a small business
- Name your person in charge of personal information (by default, you) and put their title and contact details on your website.
- Publish a plain-language privacy policy and your governance rules: retention, staff roles, complaints.
- List every tool that tracks, locates or profiles visitors and make sure none of it's on by default.
- Rewrite consent requests so each purpose is asked separately and clearly.
- Run a privacy impact assessment for each tool that stores data outside Quebec, and keep the written agreements.
- Start an incident register, even if it stays empty.
If you're starting from zero, our guide to whether a small business website needs a privacy policy covers the basics, and this explainer on Google Analytics cookies helps with the tracking audit.
My advice
Start with the two things anyone can check from outside: the named person's contact details and the privacy policy on your site. Then switch off any profiling or location feature that's on by default. Those three fixes cover the parts of Law 25 a customer, or the CAI, would notice first.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Frequently asked questions
What is Quebec Law 25?
Law 25 is a law adopted in 2021 that made significant changes to Quebec's privacy laws for businesses and public bodies, including new rules on consent, transparency, privacy incidents and penalties.
Who is responsible for privacy under Law 25?
The person with the highest authority in the business is responsible by default and can delegate the role in writing. Their title and contact details must be published on the business's website.
Does Law 25 apply to cookies?
The privacy-by-default rule doesn't apply to cookie privacy settings, but technology that can identify, locate or profile someone can't be switched on by default and people must be told about it first.
What are the penalties under Law 25?
The CAI can impose administrative monetary penalties on businesses. It gives the example that they could reach 2% of worldwide turnover or $10 million.
Can I send customer data outside Quebec under Law 25?
Yes, but first you must carry out a privacy impact assessment showing the data would get adequate protection, and the transfer must be covered by a written agreement.
