Regulations

What is Québec Law 25?

Québec Law 25 is a law that modernised Québec’s public- and private-sector privacy legislation. It strengthened organisations’ responsibilities for personal information and expanded individuals’ control over how that information is handled.

Law 25 received assent on 22 September 2021. Its principal changes took effect in stages:

Date	Examples of changes
22 September 2022	Privacy-officer responsibilities and confidentiality-incident obligations.
22 September 2023	Major governance, transparency, consent and privacy-impact-assessment requirements.
22 September 2024	The right to obtain qualifying computerised personal information in a structured, commonly used technological format.

For websites, relevant responsibilities include publishing a clear privacy policy when collecting personal information through technological means and explaining the purposes of collection.

The Commission d’accès à l’information’s Law 25 overview explains these changes.

Law 25 is a Québec reform, not a single privacy law governing all of Canada. Its application must be assessed alongside other relevant Canadian legislation.

A website’s Québec Law 25 compliance should connect its disclosures, cookie consent choices and actual data practices. Displaying a banner alone does not satisfy the wider obligations.