Quebec Law 25
Quebec's law modernizing the protection of personal information, which brought obligations similar to GDPR for organizations handling data about Quebecers.
In short
- It took effect in stages between September 2022 and September 2024.
- Every organization must have a person in charge of personal information, the CEO by default.
- Penalties can reach $25 million or 4% of worldwide turnover for the most serious offences.
Law 25, adopted in 2021 as Bill 64, updated Quebec's private sector privacy law. It applies to businesses that collect, hold, use or share personal information about people in Quebec, including companies based outside the province.
Key obligations
- Person in charge: the head of the organization is responsible for protecting personal information by default, and may delegate the role in writing. Their title and contact details must be published.
- Confidentiality incidents: incidents that present a risk of serious injury must be reported to the Commission d'accès à l'information and to the people affected, and all incidents must be logged.
- Governance policies: organizations must adopt and publish policies on how they handle personal information.
- Privacy impact assessments: required before communicating personal information outside Quebec and for certain new systems.
- Consent and transparency: consent must be clear, specific and requested separately for each purpose.
- Data portability: individuals can ask for their information in a structured, commonly used technological format.
Penalties
Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4%, whichever is greater.
Why it matters for finance
Receipts, expense reports, payroll and supplier records contain personal information. Choosing service providers that store data securely, knowing where it is hosted and limiting retention to what is needed all fall under Law 25.
Worked example
Choosing an expense platform
A Quebec company selecting expense software learns that receipt images would be stored in the United States. Before signing, it completes a privacy impact assessment, confirms the provider's security measures and adds contract terms on confidentiality and incident reporting. It chooses a provider that keeps data resident in Canada, which simplifies the assessment.