Quebec Law 25 modernizes private-sector privacy in Quebec, with penalties up to $25 million CAD or 4 percent of worldwide turnover, whichever is greater.
Quebec Law 25 for Canadian startups · Quebec Law 25 cost in CAD
Any organization doing business in Quebec or handling the personal information of Quebec residents.
The core of what Quebec Law 25 asks you to put in place.
Ongoing law with phased obligations now in force. A readiness sprint to close gaps across governance, consent, PIAs, and the incident process commonly runs a few weeks to a few months.
We run a Law 25 readiness sprint: privacy governance, consent and transparency, privacy impact assessments, automated-decision disclosure, and CAI incident-reporting workflows — bilingual where required, and aligned with PIPEDA.
See Security and Compliance, or compare estimated Quebec Law 25 cost in CAD. Based in Toronto and led by a published CVE researcher, we deliver across Canada and the US with our partner Lorikeet Security.
Administrative and penal penalties can reach up to $25 million CAD or 4 percent of worldwide turnover, whichever is greater.
Quebec Commission d access a l information (CAI).
Yes. Confidentiality incidents posing a risk of serious injury must be reported to the CAI and affected individuals, with a register of incidents maintained.
When a decision is based exclusively on automated processing, individuals must be informed and, on request, given the reasons and the principal factors that led to the decision.
Usually yes. Law 25 governs Quebec, while PIPEDA covers federally regulated and cross-border activity. Most organizations align both.
Book a free discovery call. We will tell you whether Quebec Law 25 fits, what it would take, and roughly what it would cost.