Quebec Law 25
What the law asks of a Quebec business, when each part came into force, and how AlloTech.AI helps you get ready. Checked against the summary published by the Commission d'accès à l'information (CAI).
General information, not legal advice.
Timeline
Law 25 was adopted in 2021 and came into force in stages. Every stage now applies.
September 2022
The person with the highest authority is responsible for protecting personal information. Confidentiality incidents that present a risk of serious harm must be reported to the CAI and to the people concerned, and every incident goes in a register.
September 2023
Governance policies and practices, a privacy policy in plain language, the new consent rules, privacy impact assessments, transparency at collection, privacy by default, the rules on automated decisions and de-indexing, and the CAI's power to impose penalties.
September 22, 2024
On request, a person must receive the computerized personal information collected from them in a structured, commonly used technological format. They can also ask that it be sent to another person or organization authorized to collect it.
Obligations
Grouped the way the CAI presents them.
Anyone who operates a business is responsible for the personal information it holds. The person with the highest authority holds the role of privacy officer and can delegate it in writing, in whole or in part. The officer's title and contact information must be published on the company website.
A business must establish and apply policies covering, among other things, how long information is kept and how it is destroyed, staff roles and responsibilities through the information's life cycle, and a process for handling complaints. Detailed information about them must be published on its website.
If you collect personal information by technological means, you must publish a privacy policy written in clear and simple terms, and tell people when it changes.
Consent must be requested for each specific purpose, in clear and simple terms. A written request must be presented separately from any other information. Information cannot be used for another purpose without consent, and using sensitive information for a new purpose requires express consent.
When you collect information you must state the purposes, the means, the rights of access and rectification and the right to withdraw consent. People must also be told which third parties are involved and whether the information could be communicated outside Quebec.
A PIA is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and before communicating personal information outside Quebec. It must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information.
Information can be communicated outside Quebec only if the assessment shows it would receive adequate protection, and the communication must be covered by a written agreement.
When an incident presents a risk of serious harm, the business must notify the CAI and the people concerned. It must keep a register of all incidents and provide it to the CAI on request. The CAI summary sets no fixed number of hours; do not wait.
A technological product or service offered to the public must provide the highest level of confidentiality by default, without any action by the person. This does not apply to the privacy settings of a cookie.
If a technology you use can identify, locate or profile a person, you must tell them beforehand and explain how to activate those functions. They cannot be switched on by default.
When a decision is based exclusively on automated processing, the person must be told no later than when they are informed of the decision, and must be given the chance to submit observations to a staff member able to review it.
Information is sensitive when, by its medical, biometric or otherwise intimate nature, or because of its context, it carries a high reasonable expectation of privacy. Biometric information is sensitive. A biometric database must be disclosed to the CAI at least 60 days before it goes into service, and express consent is required.
People's rights
Since September 22, 2024: their computerized information, in a structured and commonly used format.
To stop disseminating their information, or to de-index a link attached to their name, when it causes them harm or contravenes the law or a court order.
Information about a child under 14 cannot be collected from the child without the consent of the parent or tutor, unless the collection is clearly for the child's benefit.
Which information was collected from them, the categories of people who have access to it inside your organization, how long it is kept, and how to reach your privacy officer.
How AlloTech.AI helps
What the platform gives you to do the work, and what it does not do for you.
Services
A 30-minute initial assessment with our team to frame your needs. The full diagnostic and your personalized plan are delivered within 5 days, with no commitment.
The law lets the person with the highest authority delegate the privacy officer function in writing. AlloTech can take on that function for you; what matters is that the person is identified and their contact information is published.
FAQ
Yes. The private-sector Act applies to anyone who operates a business and holds personal information; the CAI summary makes no exception for size. What changes with size is how much there is to do, since measures such as a PIA are meant to be proportionate.
You are. The role belongs by default to the person with the highest authority in the business. You can delegate it in writing, and your title and contact information must be published on your website.
The CAI summary gives no fixed deadline in hours. If an incident presents a risk of serious harm, notify the CAI and the people concerned without delay, and enter every incident in your register.
The CAI can impose administrative monetary penalties, which it indicates could reach $10 million or 2% of worldwide turnover, and penal proceedings are possible. The obligations already apply: all three stages are in force.
No. The platform provides readiness tools and safeguards. An organization's compliance depends on its own practices, and we do not certify it on your behalf.
Yes. The obligations above apply across sectors. Write to us through the contact page and we will look at your situation.
Source for the legal statements on this page: Commission d'accès à l'information du Québec, « Principaux changements apportés par la Loi 25 », consulted on October 7, 2026. The CAI's page and the official texts of the laws prevail over this summary. cai.gouv.qc.ca
Thirty minutes to frame your situation, then a written plan within 5 days.