Quebec. Comprehensive data protection. Act
Quebec Private Sector Act / Law 25Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c. 25)
§1Summary
- Synopsis
Quebec's private-sector privacy statute, heavily modernised by Law 25 to resemble the GDPR. It requires a person in charge of personal information, PIAs, privacy by default, incident notification, transparency about automated decisions and grants portability and de-indexing rights.
- Key themes
- Unique features
Most GDPR-like regime in Canada: CAI can levy AMPs, penal fines reach 4% of worldwide turnover, and there is a private right of action with punitive damages. Biometric databases must be disclosed to the CAI 60 days before use.
- SaaS relevance
Any enterprise collecting personal information about Quebec residents in the course of business is caught, regardless of where the SaaS provider is located.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- CAI and individuals promptly where risk of serious injury; incident register
- DPO
- Yes
- Cross-border transfers
- PIA before communicating PI outside Quebec + written agreement
- Maximum penalty
- AMPs up to CAD 10m or 2% worldwide turnover; penal fines up to CAD 25m or 4%
§3Dates
- Key dates
- Adopted
- In force
- Law 25 assented 2021-09-22; phased: 2022-09-22 (privacy officer, incident reporting), 2023-09-22 (most obligations, PIAs, transfers, AMPs), 2024-09-22 (data portability)
§4Text and authority
- Text
- Authoritative text legisquebec.gouv.qc.ca
- Authority
- Commission d'accès à l'information du Québec (CAI)
§5Where it applies
- Domestic law of
- Quebec
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Declared substantially similar to PIPEDA. Head of the enterprise is the default person in charge, delegable in writing.