# Quebec Law 25: What Every Business Needs to Know - Link: https://dbr-soft.com/quebec-law-25-what-every-business-needs-to-know/ - Published: 2026-10-09T15:49:31+00:00 - Author: David Botero Quebec’s Law 25 (formerly Bill 64) modernized the province’s private-sector privacy rules. It was phased in between 2022 and 2024, and it applies to most businesses that collect or use personal information about people in Quebec, including businesses located elsewhere. _**This article is general information, not legal advice. Consult a lawyer for your specific situation.**_ **The main obligations** **1. Designate a person in charge of privacy.** Someone must be responsible for protecting personal information. By default, this is the highest-ranking person in the organization, though the role can be delegated in writing. Their contact information must be published on your website. **2. Publish clear privacy policies.** If you collect personal information through your website, you need a privacy policy written in clear, simple language. **3. Obtain proper consent.** Consent must be clear, free, informed, and given for specific purposes. Bundling everything into one vague checkbox is no longer enough. **4. Report confidentiality incidents.** If a breach presents a risk of serious injury, you must notify the Commission d’accès à l’information (CAI) and the affected individuals. You must also keep a register of all confidentiality incidents, even minor ones. **5. Conduct privacy impact assessments (PIAs).** Required for any project involving the acquisition, development, or overhaul of an information system that handles personal information. Also required before transferring personal information outside Quebec. **6. Respect individual rights.** People can request access to their data, ask for corrections, and in some cases request that data be deleted or de-indexed. Since September 2024, the right to data portability also applies. **Penalties** Penalties can be significant. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater. **Where IT comes in** Law 25 requires “reasonable security measures.” In practice, that means: – Multi-factor authentication on email and critical systems – Encryption of laptops, phones, and backups – Access controls so staff see only what they need – Up-to-date patching and endpoint protection – A tested incident response plan – Logging and monitoring, so you can tell what was affected if something goes wrong – Careful vetting of cloud vendors and where they store your data **A practical starting point** 1. Map what personal information you hold and where it lives 2. Name your privacy officer and publish their contact details 3. Review your website privacy policy and consent forms 4. Create an incident register and response plan 5. Review your IT security controls against your risks You don’t need to do it all in a week, but you do need to start. Visit the link below to review the Quebec government’s publication regarding the law. Sources: [https://www.legisquebec.gouv.qc.ca/fr/document/lc/p-39.1?langCont=en](https://www.legisquebec.gouv.qc.ca/fr/document/lc/p-39.1?langCont=en) **DBR Soft helps Quebec businesses put the technical safeguards in place.**[ **Reach out to us for a security and privacy readiness review.**](https://dbr-soft.com/contact/) * [⌊Massive Binance Breach: $6.3 Billion Drained in History’s Largest Crypto Heist⌉⌊ Massive Binance Breach: $6.3 Billion Drained in History’s Largest Crypto Heist⌉[ * [Cybersecurity](https://dbr-soft.com/category/cybersecurity/), [IT News](https://dbr-soft.com/category/it-news/) * ### 󠀁[Massive Binance Breach: $6.3 Billion Drained in History’s Largest Crypto Heist](https://dbr-soft.com/massive-binance-breach-6-3-billion-drained-in-historys-largest-crypto-heist/)󠁿 * Binance has halted all user withdrawals following a devastating “complex attack” that drained approximately $6.3… * [⌊David Botero Avatar⌉⌊David Botero Avatar⌉[ * [David Botero](https://dbr-soft.com/author/dave/) * Oct 30, 2026 * [⌊Epic Games Goes All-In on AI Acceleration for Fortnite and Unreal Engine 6⌉⌊ Epic Games Goes All-In on AI Acceleration for Fortnite and Unreal Engine 6⌉[ * [Artificial Intelligence](https://dbr-soft.com/category/artificial-intelligence/), [Gaming News](https://dbr-soft.com/category/gaming-news/), [Trends](https://dbr-soft.com/category/trends/) * ### 󠀁[Epic Games Goes All-In on AI Acceleration for Fortnite and Unreal Engine 6](https://dbr-soft.com/epic-games-goes-all-in-on-ai-acceleration-for-fortnite-and-unreal-engine-6/)󠁿 * CHICAGO — Epic Games is no longer just experimenting with artificial intelligence; they are rewriting… * [⌊David Botero Avatar⌉⌊David Botero Avatar⌉[ * [David Botero](https://dbr-soft.com/author/dave/) * Oct 30, 2026 * [⌊The Dawn of Optical Computing: How Akhetonics is Building the First All-Optical Processor⌉⌊The Dawn of Optical Computing: How Akhetonics is Building the First All-Optical Processor⌉[ * [Artificial Intelligence](https://dbr-soft.com/category/artificial-intelligence/), [Hardware](https://dbr-soft.com/category/hardware/), [Innovation](https://dbr-soft.com/category/innovation/) * ### 󠀁[The Dawn of Optical Computing: How Akhetonics is Building the First All-Optical Processor](https://dbr-soft.com/the-dawn-of-optical-computing-how-akhetonics-is-building-the-first-all-optical-processor/)󠁿 * As artificial intelligence, quantum computing, and massive data centers push the limits of modern technology,… * [⌊David Botero Avatar⌉⌊David Botero Avatar⌉[ * [David Botero](https://dbr-soft.com/author/dave/) * Oct 29, 2026 [View All](https://dbr-soft.com/quebec-law-25-what-every-business-needs-to-know/#extendify-blog)