CA — QuebecQuebec Law 25: Complete Compliance Guide
Overview
Quebec Law 25, also known as the Act Respecting the Protection of Personal Information in the Private Sector, governs how businesses handle personal data in Quebec. The Act mandates specific rules regarding the collection, use, retention, and communication of personal information by enterprises, including provisions for transparency and security. Law 25 aims to ensure individuals' privacy rights are respected while establishing responsibilities for businesses to maintain the protection of personal information.
Quebec Consumer Rights Under the Quebec Law 25
The Quebec Law 25 grants five individual privacy rights to Quebec residents. Businesses must respond to authenticated requests within 30 days.
Request access to the information we have collected about you
30-day response windowDelete personal information we have collected about you
30-day response windowRequest a copy of personal information we have collected about you
30-day response windowCorrect inaccurate or incomplete information we have collected about you
30-day response windowLet us know that you don't want us to process your personal information
30-day response windowHow Clym Helps You Comply with the Quebec Law 25
Configurable consent banner that asks for opt-in consent before non-essential cookies run, and a full consent audit log.
Clym's Data Subject Request portal handles every Quebec Law 25 request type, with built-in 30-day deadline tracking and escalation alerts.
Clym scans your site and generates your Quebec Law 25-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- Enacted: June 15, 1993
- Updated: September 22, 2024
- Enforcement Timeline:
- September 22, 2022: Major provisions on the collection, use, and retention of personal information began to take effect.
- September 22, 2023: New rights for data subjects, including the right to data portability, were enforced.
- September 22, 2024: Full enforcement of all provisions, including privacy impact assessments and requirements for governance policies.
- Private-sector organizations operating in Quebec.
- Companies processing personal information about Quebec residents.
- Public bodies.
- Personal domestic use.
- Designate a Privacy Officer.
- Conduct privacy impact assessments.
- Implement security measures and document practices.
- Present clear privacy notices.
- Obtain consent for data collection.
- Provide data access and enable withdrawal.
- Report confidentiality incidents.
- Maintain a record of incidents.
- Access.
- Rectification.
- Anonymization.
- Withdrawal of consent.
- Authority: Commission d’accès à l’information (CAI).
- Fines: Up to CAD $25 million or 4% of global turnover.
- Investigations and penalties.