Quebec’s Law 25 (formerly Bill 64) modernized the province’s private-sector privacy rules. It was phased in between 2022 and 2024, and it applies to most businesses that collect or use personal information about people in Quebec, including businesses located elsewhere.

This article is general information, not legal advice. Consult a lawyer for your specific situation.

The main obligations

1. Designate a person in charge of privacy.

Someone must be responsible for protecting personal information. By default, this is the highest-ranking person in the organization, though the role can be delegated in writing. Their contact information must be published on your website.

2. Publish clear privacy policies.

If you collect personal information through your website, you need a privacy policy written in clear, simple language.

3. Obtain proper consent.

Consent must be clear, free, informed, and given for specific purposes. Bundling everything into one vague checkbox is no longer enough.

4. Report confidentiality incidents.

If a breach presents a risk of serious injury, you must notify the Commission d’accès à l’information (CAI) and the affected individuals. You must also keep a register of all confidentiality incidents, even minor ones.

5. Conduct privacy impact assessments (PIAs).

Required for any project involving the acquisition, development, or overhaul of an information system that handles personal information. Also required before transferring personal information outside Quebec.

6. Respect individual rights.

People can request access to their data, ask for corrections, and in some cases request that data be deleted or de-indexed. Since September 2024, the right to data portability also applies.

Penalties

Penalties can be significant. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater.

Where IT comes in

Law 25 requires “reasonable security measures.” In practice, that means:

– Multi-factor authentication on email and critical systems

– Encryption of laptops, phones, and backups

– Access controls so staff see only what they need

– Up-to-date patching and endpoint protection

– A tested incident response plan

– Logging and monitoring, so you can tell what was affected if something goes wrong

– Careful vetting of cloud vendors and where they store your data

A practical starting point

1. Map what personal information you hold and where it lives

2. Name your privacy officer and publish their contact details

3. Review your website privacy policy and consent forms

4. Create an incident register and response plan

5. Review your IT security controls against your risks

You don’t need to do it all in a week, but you do need to start.

Visit the link below to review the Quebec government’s publication regarding the law.

Sources:
https://www.legisquebec.gouv.qc.ca/fr/document/lc/p-39.1?langCont=en

DBR Soft helps Quebec businesses put the technical safeguards in place. Reach out to us for a security and privacy readiness review.