What Law 25 actually requires
Quebec's modernisation of its private-sector privacy law (originally Bill 64). Law 25 introduces several stricter obligations than PIPEDA — including a requirement that confidentiality functions be enabled by default and that automated decisions be disclosed. The law is enforced by the Commission d'accès à l'information du Québec.
Key requirements
- Obtain express consent for collection and use of personal information
- Provide privacy-by-default settings on tools that collect personal information
- Notify users of any automated decision-making and offer a human review path
- Appoint a person responsible for protecting personal information
- Report confidentiality incidents that present a risk of serious injury
- Conduct privacy impact assessments before launching new collection systems
At a glance
Full name
Quebec Act to modernize legislative provisions as regards the protection of personal information
Region
Quebec, Canada
Status
Phased in 2022–2024
Who it affects
Any private-sector organisation that collects, holds, uses or communicates personal information in Quebec — whether the organisation itself is based in Quebec or not.
Penalties
Administrative penalties of up to CAD 10 million or 2% of worldwide turnover; criminal penalties up to CAD 25 million or 4% of worldwide turnover. Some of the steepest fines in Canadian privacy law.
How GrantCookie covers it
Compliant defaults
Opt-in by default, granular categories, and a reject button as prominent as accept — the configuration regulators expect.
Provable records
Every consent is timestamped and stored with the banner version, so you can show exactly what was agreed to.
Easy withdrawal
A persistent re-open control lets visitors change their mind at any time, exactly as the law requires.
This page is general guidance, not legal advice. Check your specific obligations with a qualified adviser.