Quebec Law 25 for companies outside Quebec
Quebec Law 25 can apply to a company outside Quebec directly, and very often reaches it through its Quebec customers. Law 25 amended Quebec’s private-sector privacy Act, whose text sets no test based on where an enterprise is located. What is certain is the contract route: a Quebec business that sends personal information to a provider outside Quebec must assess the transfer and sign a written agreement first, so the obligations reach you anyway. Plan as though the Act applies, and confirm the position with counsel.
Does Law 25 apply to companies outside Quebec?
The Act attaches to personal information handled in the course of carrying on an enterprise, and its text sets no test based on where the enterprise is located. Whether it reaches your organization directly is a question to settle with counsel; if you hold information about people in Quebec, plan as though it does. The statute is the Act respecting the protection of personal information in the private sector, CQLR c P-39.1; “Law 25” is the 2021 amending statute.
The common myth runs the other way: that a company outside Quebec is safe because the Commission d’accès à l’information cannot easily reach it. That misses how the obligations usually travel.
How does Law 25 reach a supplier in another province?
Usually through your customer. A Quebec business that hands personal information to a provider outside Quebec must first assess the transfer and put a written agreement in place, so the obligations arrive in your contract even when the statute does not reach you directly. Section 17 requires a privacy impact assessment before personal information is communicated outside Quebec, weighing the sensitivity of the information, the purposes, the protection measures and the legal framework where it is going. The information may be communicated if the assessment establishes it would receive adequate protection, under a written agreement. The same rule applies when a provider outside Quebec is entrusted with the information.
In practice, a Quebec customer will send you a questionnaire and a data processing agreement. Answering them well is faster than arguing about jurisdiction.
What does Law 25 require of an enterprise?
| Obligation | Section | What to build |
|---|---|---|
| Person in charge of personal information | 3.1 | A named role, published title and contact |
| Governance policies | 3.2 | Retention, roles, complaints; published in plain language |
| Privacy impact assessments | 3.3, 17 | For new or overhauled systems, and before transfers outside Quebec |
| Confidentiality incidents | 3.5, 3.8 | Notice where there is a risk of serious injury; a register of all incidents |
| Consent | 14 | Clear, free, informed, for specific purposes, requested for each one |
An incident here is broader than a breach: unauthorized access, use or communication, or loss of the information (s. 3.6). Where one presents a risk of serious injury, the enterprise must promptly notify the Commission and the people concerned (s. 3.5). Whether a given incident meets that test is a legal determination for your counsel.
What should a supplier outside Quebec do first?
- Find the Quebec data. Which systems hold information about people in Quebec, and which providers touch it.
- Name the person in charge. By default, the person in charge of personal information is the person exercising the highest authority in the enterprise, who may delegate all or part of the function in writing to any person. The title and contact information of whoever holds it must be published on your website, or made available by other appropriate means if you have none.
- Start the incident register. Every confidentiality incident goes in the register, not only the ones serious enough to report, and the Commission can ask for a copy. Build it before you need it.
- Template the transfer assessment. You will run it for every provider and every new system, so make it proportionate and repeatable.
- Fix consent wording. One request per purpose, in clear and simple language, and presented separately from other information when made in writing (s. 14).
If you already run a PIPEDA or BC PIPA program, most of this extends it rather than replacing it. The gaps are usually the published governance policies and the transfer assessments. The wider map is in which Canadian privacy law applies, and the method in privacy impact assessments.
What are the penalties under Law 25?
A person designated by the Commission may impose monetary administrative penalties for failures including unlawful handling, failing to report an incident and inadequate security (s. 90.1). As of September 2026, for an organization, the ceiling is a fixed maximum or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12). Penal fines under s. 91 follow the same design with a higher ceiling: a fixed maximum or 4% of worldwide turnover, whichever is greater. The point is the design: the ceiling grows with the company. The current amounts are in the official text.
How the work is bounded
The scope is agreed in writing before work starts, and the engagement is quoted in writing with it.
SecHB does not issue certifications, attestations or audit opinions: those come from accredited certification bodies, CPA firms and QSAs. The work here is what an organization does to be ready for them.
Nothing here is legal advice. Where a question turns on the law, the work is done alongside the client’s counsel, not instead of them.
Questions we are asked
Does Law 25 apply to a company outside Quebec?
The Act attaches to personal information handled in the course of carrying on an enterprise, and its text sets no test based on where the enterprise is located. Whether it reaches your organization directly is a question to settle with counsel; if you hold information about people in Quebec, plan as though it does.
How does Law 25 reach an out-of-province supplier?
Usually through your customer. A Quebec business that hands personal information to a provider outside Quebec must first assess the transfer and put a written agreement in place, so the obligations arrive in your contract even when the statute does not reach you directly.
Who is the person in charge of personal information?
By default, the person in charge of personal information is the person exercising the highest authority in the enterprise, who may delegate all or part of the function in writing to any person. The title and contact information of whoever holds it must be published on your website, or made available by other appropriate means if you have none.
Do we record incidents we do not report?
Every confidentiality incident goes in the register, not only the ones serious enough to report, and the Commission can ask for a copy. Build it before you need it.
Getting ready for a Quebec customer
Send the questionnaire or agreement a Quebec customer has sent you. We work alongside your counsel on the program behind the answers; see Canadian privacy readiness, and more at writing.