Law 25 applies to every business in Québec that collects personal information, whatever its size. Since September 2024, all of its obligations are in force. The essentials: appoint a person in charge, publish your policies, manage incidents and protect data with reasonable security measures.
This guide summarizes the law and the publications of Québec’s Commission d’accès à l’information (CAI). It does not replace legal advice.
The three implementation dates
| Date | What came into force |
|---|---|
| September 22, 2022 | Person in charge of the protection of personal information; handling, reporting and register of confidentiality incidents |
| September 22, 2023 | Governance policies, privacy impact assessments (PIAs), consent and transparency, tracking technologies, transfers outside Québec, destruction and anonymization, penalties |
| September 22, 2024 | Right to data portability |
Your main obligations
- A designated person in charge. By default, this is the person with the highest authority in the business. They can delegate in writing. Their title and contact details must be published on your website (s. 3.1).
- Published policies. Retention, destruction, roles and complaint handling, explained in plain language (s. 3.2).
- Confidentiality incidents. Reduce the harm, keep a register of all incidents (kept at least 5 years), and notify the CAI and affected people when there is a risk of serious injury (ss. 3.5 to 3.8).
- PIAs. Required for any information system or electronic service project, and before any transfer of information outside Québec, including to a cloud service (ss. 3.3 and 17).
- Consent. It must be manifest, free, enlightened and given for specific purposes, requested for each purpose (s. 14).
- Tracking technologies. If a tool can identify, locate or profile a person, you must inform them, and the CAI states these functions must not be enabled by default (s. 8.1). For analytics cookies, lawyers do not agree yet: asking for consent is the prudent practice.
- Portability. On request, provide the information a person gave you in a structured, commonly used format (s. 27).
- Destruction. Destroy or anonymize information once it is no longer needed, subject to legal retention periods (s. 23).
Penalties, and what really happens
| Type | Maximum for a business |
|---|---|
| Administrative penalty (CAI) | $10M or 2% of worldwide turnover, whichever is higher |
| Penal fine | $25M or 4% of worldwide turnover, whichever is higher (doubled for repeat offences) |
| Punitive damages (civil lawsuit) | At least $1,000 if the fault is intentional or gross |
These maximums are scary, but here are the facts. To our knowledge, as of October 2026, the CAI has not published any monetary penalty against a named business. Under the CAI’s framework, base amounts range from $1,000 to $15,000 depending on severity. In 2024-2025, the CAI received 514 incident reports and 549 complaints. Be wary of “real cases” of fines circulating on some websites: we could not verify any of them.
The real risk for an SMB is not the maximum fine. It is the incident itself, and then having to notify your clients.
The security required
The law requires “reasonable” security measures, suited to the sensitivity of the information (s. 10). The CAI’s guide on preventing incidents (January 2026) gives concrete examples:
- access limited to what is strictly needed, with logging;
- strong passwords and robust identification;
- encryption of data, communications and mobile devices;
- firewalls and systematic updates;
- staff training;
- penetration and vulnerability testing;
- an incident response plan.
The CAI points out that an incident is “highly likely”: you need to prepare for it, not hope it won’t happen.
Your 12-step checklist
- Confirm or delegate the person in charge in writing, and publish their title and contact details on your website.
- Adopt and publish your governance policies.
- Inventory the personal information you hold and how sensitive it is.
- Publish a clear privacy policy and inform people at the time of collection.
- Review your forms: one consent per purpose, express consent for sensitive information.
- Check the cookies and tracking tools on your website.
- Run a PIA for every new system and every transfer outside Québec, including cloud services.
- Add confidentiality clauses to contracts with your suppliers, including your IT provider.
- Put reasonable security measures in place: access, authentication, encryption, updates, training, testing.
- Write an incident response plan, keep an incident register and plan for reporting to the CAI.
- Set retention periods and a secure destruction method.
- Be ready to respond to access and portability requests.
The UpSystems advantage: the technical side of Law 25
Steps 3, 9 and 10 are technical, and they are often where SMBs get stuck. That is our job.
- Security audit ($300 to $2,500, 1 to 2 days). We check your access, backups and configurations, and you get a documented remediation plan.
- Penetration test (from $4,000). Proof that your measures hold, with a report you can show the CAI, your insurer or your clients.
- Managed services (from $25 per user per month). Updates, monitoring and, as options, advanced endpoint protection, 24/7 monitoring and anti-phishing training.
- We apply the law to ourselves too. Our own Law 25 compliant privacy policy is published on our website.
For the legal side (policies, contracts, consent), we work with your legal advisor. Book a 30-minute call to review your security.
Frequently asked questions
Does Law 25 apply to small businesses?
Yes. The law has no exemption based on size.
Who must be in charge of the protection of personal information?
The person with the highest authority, unless they delegate this role in writing.
What are the Law 25 fines?
Up to $10M or 2% of worldwide turnover as an administrative penalty, and $25M or 4% as a penal fine. No monetary penalty against a named business has been published to date.
Do I need a cookie banner?
Tools that can identify, locate or profile people must be off by default. For analytics cookies, interpretations vary; asking for consent is the prudent practice.
What should I do after a confidentiality incident?
Reduce the harm, record it in the register and, if there is a risk of serious injury, notify the CAI through its online form and the affected people.
Does Law 25 require a penetration test?
No, but the CAI lists it as a way to check your security measures.