Quebec did not wait for federal reform. Law 25 (Bill 64) turned the province’s 1994 private-sector privacy act into the most demanding privacy law in North America, phased in between September 2022 and September 2024 and now fully in force. If your business touches Quebec residents, the safe assumption is that GDPR-grade obligations apply, enforced by the Commission d’accès à l’information with fines up to 4% of worldwide turnover.
| Regulation | Quebec P-39.1, as amended by Law 25 |
|---|---|
| Fully in force | 22 September 2024 (final phase: portability) |
| Max penalty | CAD 25M or 4% of worldwide turnover |
| Enforcing authority | CAI |
| Official text | LégisQuébec P-39.1 |
The obligations that define the law
Governance. The person with highest authority is the privacy officer by default; the function can be delegated in writing, and the officer’s title and contact information must be published on your website. Policies and practices governing the information lifecycle must exist and be published in clear language.
Consent. Must be clear, free, informed, and purpose-specific, requested in clear and simple language, and separately from other terms. Sensitive information (medical, biometric, otherwise intimate) needs express consent. Minors under 14 require parental consent.
PIAs and transfers. Privacy impact assessments are mandatory for new or overhauled systems handling personal information and before any communication of personal information outside Quebec, where the assessment must confirm the destination offers adequate protection, contractually reinforced if needed; see the dedicated Quebec PIA guide.
Technology rules. Privacy by default for public-facing products (section 9.1). Individuals must be informed when technology allows them to be identified, located, or profiled, and how to activate those functions, which is why cookie banners in Quebec increasingly resemble EU ones. Decisions based exclusively on automated processing must be disclosed, with a right to have them reviewed by a person. Biometric databases must be declared to the CAI before use, covered in the biometric registration guide.
Rights. Access and rectification, withdrawal of consent, de-indexing (a Quebec right to be forgotten), automated-decision explanation, and, since September 2024, portability of computerized personal information in a structured, commonly used technological format.
Breaches. Any confidentiality incident presenting a risk of serious injury must be reported to the CAI and affected individuals, with an incident register kept regardless of severity.
Enforcement and strategy
The CAI can issue orders and administrative monetary penalties (to CAD 10 million or 2% of turnover); prosecutors can pursue penal fines to CAD 25 million or 4%, doubled on repeat. The private right of action adds minimum CAD 1,000 punitive damages per person for unlawful intentional or grossly negligent infringements, a class-action magnet.
Most organizations already running GDPR programs can map controls across; the Quebec-specific work is the published officer, French-language notices, the pre-transfer assessments, and biometric declarations, laid out against PIPEDA and GDPR in the triple compliance guide. Start by seeing what your site does to Quebec visitors before consent with a free scan.