Quebec Law 25.

## What it is Law 25 (formerly Bill 64) is Quebec's comprehensive privacy modernization act, adopted September 22, 2021. It amends the Act Respecting the Protection of Personal Information in the Private Sector (P-39.1) and the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information. Enforced by the Commission d'accès à l'information (CAI), it introduces GDPR-adjacent requirements and Canada's most punitive privacy penalties to date. ## Who it applies to Any enterprise or public body collecting, holding, using, or disclosing personal information of Quebec residents — regardless of where the enterprise is headquartered. Extraterritorial reach mirrors the GDPR pattern: if you offer goods or services to Quebec residents or monitor their behaviour, you are covered. ## Phased implementation - **September 22, 2022 (Phase 1):** Mandatory Privacy Officer designation; breach reporting to the CAI; incident register; breach notification to affected individuals; safeguards proportionate to sensitivity - **September 22, 2023 (Phase 2):** Consent requirements; automated decision-making transparency; privacy by default; data portability [VERIFY 2023 portability implementation timing]; privacy impact assessments for high-risk projects - **September 22, 2024 (Phase 3):** Right to data portability fully in force ## Key data protection requirements Enterprises must designate a person in charge of privacy (default: the person exercising the highest authority), maintain records of processing, conduct privacy impact assessments (PIAs) before implementing information systems or communicating personal information outside Quebec, and obtain express consent for sensitive personal information. Cross-border transfers require a PIA and can be blocked if the destination does not provide adequate protection. ## Breach reporting Following a confidentiality incident, enterprises must: - **Notify the CAI** and affected individuals with diligence if the incident presents a risk of serious injury - **Maintain a register** of all confidentiality incidents (regardless of severity) — the CAI can request the register - **Take reasonable measures** to reduce the risk of injury and prevent recurrence ## Penalties Administrative monetary penalties up to the greater of CAD $10 million or 2% of worldwide turnover. Penal fines up to the greater of CAD $25 million or 4% of worldwide turnover. Private right of action available for punitive damages of at least CAD $1,000 per affected individual for intentional or grossly negligent violations. These figures are the highest in Canada. ## How LeakTrace aligns LeakTrace supports Quebec entities with continuous external-surface monitoring aligned to the CAI's confidentiality-incident framework — including register-ready incident documentation, chain-of-custody evidence bundles, and cross-border-transfer risk indicators.