Quebec's Law 25 modernized the province's private-sector privacy law in three phases between 2022 and 2024. It applies to businesses that collect or use personal information about people in Quebec, including companies based elsewhere in Canada that serve Quebec customers.
The checklist
1. Name a person in charge of personal information
By default this is the CEO. The role can be delegated, and the person's title and contact information must be published on your website.
2. Keep a confidentiality incident register
Record every incident involving personal information, and be ready to provide the register to the Commission d'accès à l'information (CAI) on request.
3. Report serious incidents
When an incident presents a risk of serious injury, notify the CAI and the affected people promptly.
4. Publish a clear privacy policy
Explain in plain language what you collect, why, how long you keep it and who you share it with.
5. Get valid consent, and turn tracking off by default
Consent must be clear, specific and freely given. Technologies that can identify, locate or profile a person, such as many analytics and advertising cookies, must be off until the person turns them on.
6. Assess privacy impacts
Do a privacy impact assessment before acquiring or overhauling systems that handle personal information, and before sending personal information outside Quebec.
7. Respect individual rights
People can access and correct their information, withdraw consent, and, since September 2024, receive their data in a structured, commonly used technological format.
Penalties
Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater.
Where IT fits in
- Find and classify personal information across systems and cloud apps
- Detect incidents quickly with monitoring and logging
- Control access with MFA and least privilege
- Keep encrypted, tested backups
- Set up cookie consent on your website
Hanatech helps businesses put these controls in place. Try the free Cyber Risk Check or contact us.
This article is general information, not legal advice. For your specific situation, consult a privacy lawyer or the CAI.