Law 25 compliance automation can handle the repetitive parts of Quebec's privacy law: consent records, cookie and tracker preferences, access requests, and logging incidents into a register. It cannot make the decisions the law assigns to people. Those include who is accountable, whether an incident risks serious injury, whether a transfer outside Quebec is adequately protected, and what a privacy impact assessment concludes.
What Law 25 actually asks of a business
Law 25 amended Quebec's Act respecting the protection of personal information in the private sector. Its obligations came into force in stages in September 2022, 2023 and 2024, and the Commission d'accès à l'information (CAI) enforces them. The law reaches any business that holds personal information about people in Quebec, wherever the business is based.
Before judging any Law 25 compliance solution, list what the law requires. These are the obligations the CAI describes for private enterprises:
- A person in charge of the protection of personal information. By default this is the person with the highest authority in the business. The role can be delegated in writing, and the title and contact details must be published on your website.
- Governance policies and practices covering retention and destruction, roles across the information lifecycle, and a complaints process, with detailed information published on your website.
- Privacy impact assessments (in French, EFVP) before acquiring, developing or overhauling an information system or electronic service that involves personal information, and before personal information is communicated outside Quebec.
- Consent that is manifest, free, informed and given for specific purposes, requested separately and in plain terms.
- Transparency at collection, including the purposes, the rights to access and withdraw, and the possibility that information is communicated outside Quebec.
- Privacy by default for technology products offered to the public, plus advance notice and opt-in for technology that can identify, locate or profile a person.
- Confidentiality incidents: notifying the CAI and affected people when there is a risk of serious injury, and keeping a register of every incident.
- Individual rights, including access, correction, de-indexing, review of decisions made exclusively by automated processing, and since September 2024, data portability in a structured, commonly used format.
What Law 25 compliance software can and cannot do
Most products sold as a Law 25 compliance solution cover one or two of these areas well. The table below sets out where automation genuinely helps and where it only records a decision someone else has to make.
| Obligation | What software does well | What still needs a person |
|---|---|---|
| Consent and cookies | Banners, preference storage, consent logs with timestamps | Deciding the purposes, writing the plain-language request, choosing which trackers you keep |
| Privacy impact assessment | Questionnaire templates, workflow, version history | Assessing the risk and proportionality, and deciding whether the project goes ahead |
| Incident register | A structured log with required fields and reminders | Judging whether an incident risks serious injury, which decides whether you notify |
| Transfers outside Quebec | A vendor inventory and contract tracker | The assessment of whether the destination protects the information adequately |
| Access and portability requests | Intake forms, identity checks, deadline tracking | Finding the data in your real systems and exporting it in a usable format |
| Person in charge | Publishing contact details | Being accountable, delegating in writing, and having the authority to act |
| Governance policies | Policy templates and acknowledgement tracking | Making the policies describe what your company actually does |
The pattern holds across the list. Software can store evidence, enforce a workflow and remind you of a deadline. It cannot know where personal information sits in your production database, your support inbox or a sales spreadsheet. Every automated tool depends on a data inventory that someone has built by hand and kept true.
The consent banner: useful, but not compliance on its own
Cookie consent banners are the most visible Law 25 compliance automation, and they do real work. Law 25 requires that technology which can identify, locate or profile a person be off by default, with the person told in advance and able to turn it on. A properly configured banner that blocks non-essential trackers until the visitor opts in addresses that.
Two cautions. First, the privacy-by-default rule for public technology products has a carve-out for cookie settings, but the separate rule on identification, location and profiling technology still applies to most tracking. Configure the banner around that rule, not around the default-settings rule. Second, a banner says nothing about the rest of the law. It does not produce a privacy impact assessment, appoint a person in charge, or decide what happens when a laptop with client files is stolen. Treat it as one control among many.
Privacy impact assessments (EFVP)
The privacy impact assessment is where automation is most often oversold. The law requires the assessment to be proportionate to the sensitivity of the information, the purpose of its use, the quantity, the distribution and the medium. The person in charge must be consulted from the start of the project. A form that asks thirty questions and outputs a risk score does not meet that standard if nobody with knowledge of the system answered it carefully.
What helps is a consistent template, a register of which projects were assessed and when, and a trigger built into how your company starts projects. Most missed assessments are not skipped on purpose. A new CRM, an AI feature or an analytics tool simply went live without anyone noticing it touched personal information. Our French guide to EFVP under Law 25 covers when one is mandatory and what goes in it, and the DPIA builder produces a draft structure you can work from.
Free weekly email
Get The Compliance Brief every Tuesday
One email a week from Jacob Masse: the security and compliance stories that changed something that week, and what each one means if you sell software to enterprise buyers. Five stories, a take on each, five minutes to read.
Free. Unsubscribe in one click, and replies reach Jacob directly. Read the latest issue or browse the archive.
The confidentiality incident register
Every confidentiality incident goes in the register, including the ones that do not present a risk of serious injury. Under the regulation on confidentiality incidents, the register records what information was involved, the circumstances, when the incident happened and when you learned of it, how many people were affected, and the reasoning behind the serious-injury assessment. It must be kept for at least five years after you became aware of the incident, and given to the CAI on request.
A register is easy to automate. The hard part is the serious-injury judgement, because it decides whether you notify the CAI and the affected people. That judgement weighs the sensitivity of the information, the likely consequences of its use and the likelihood it will be misused. Software can prompt for those factors. It should not make the call. Our French page on the confidentiality incident register includes a model you can adapt.
Cross-border transfer assessments
Before communicating personal information outside Quebec, the CAI says you must carry out a privacy impact assessment, communicate it only if the information would be adequately protected, and put a written agreement in place. That covers far more than moving a database to another country. A US-hosted CRM, an email platform, a support desk or an AI model API all count.
Vendor management software can hold the inventory and the contracts. It cannot assess whether a destination protects the information adequately, because that assessment considers the sensitivity of the information, the purpose, the protection measures (including contractual ones) and the legal framework where the information goes. Our vendor DPA and subprocessor register guide shows how to keep the inventory honest, which is where most transfer assessments start.
What non-compliance can cost
Law 25 has two separate penalty regimes, and they are often merged into a single figure. The administrative monetary penalty under s. 90.12 can reach $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. The penal offence under s. 91 carries a fine of $15,000 to $25 million, or 4% of worldwide turnover, whichever is greater. The law also gives individuals a private right of action, with minimum punitive damages where an infringement is intentional or results from gross fault.
None of those penalties is avoided by owning software. The CAI looks at what you did, not what you bought.
How to choose a Law 25 compliance solution
Start from your gaps, not from a product. A business with a clean data inventory and a named person in charge might need nothing more than a consent tool and a register. A business that has never mapped where personal information goes needs that mapping first, and no tool will do it for you.
- Confirm the law applies and to which data. Our post on whether you need to comply with Quebec Law 25 walks through the test.
- Name the person in charge and delegate in writing if it should not be the CEO. The privacy officer checker helps decide, and an outsourced privacy officer is an option where nobody internal has the time.
- Build the data inventory, then run a gap assessment against the full list of obligations.
- Buy tooling for the gaps it closes, and write down which obligations it does not cover.
- Schedule the recurring work: register reviews, assessment triggers, policy reviews and request handling.
When you evaluate a product, ask which of the obligations above it covers, what it stores and where, whether the vendor itself communicates your information outside Quebec, and what you can export if you leave. We cover the full requirement list in our Quebec Law 25 requirements checklist and the wider programme in Quebec Law 25 compliance.
Common questions about Law 25 compliance automation
Can Law 25 compliance be fully automated?
No. Software can manage consent records, request intake, the incident register and policy acknowledgements. Law 25 assigns several decisions to people: who is accountable for personal information, whether an incident risks serious injury, whether a transfer outside Quebec is adequately protected, and what a privacy impact assessment concludes. Automation supports those decisions by keeping the evidence, but it cannot make them for you.
Is a cookie consent banner enough for Law 25?
No. A banner that blocks non-essential trackers until a visitor opts in addresses Law 25's rule on technology that can identify, locate or profile a person. It does not cover the person in charge, privacy impact assessments, governance policies, the incident register, transfer assessments or individual rights. It is one useful control, not a compliance programme.
Who is the person in charge of the protection of personal information?
By default it is the person with the highest authority in the business, usually the CEO. The role can be delegated in writing, in whole or in part, to someone inside or outside the company. The person's title and contact details must be published on the company's website or made available by another appropriate means.
How long must the Law 25 incident register be kept?
The regulation on confidentiality incidents requires the register to be kept for at least five years after the business became aware of the incident. Every incident goes in it, including those that do not present a risk of serious injury, and the register must be given to the Commission d'accès à l'information on request.
Does Law 25 apply to companies outside Quebec?
Yes. It applies to any business that collects, holds, uses or communicates personal information about people in Quebec in the course of carrying on an enterprise, regardless of where the business is headquartered. A Toronto or Vancouver company with Quebec customers, users or employees is covered for that information.
Find the gaps before you buy the tool. A Law 25 gap assessment maps where personal information goes and lists what is missing, so you only automate what needs automating.
Law 25 readinessOr book a call