Law 25 is modernizing how personal data is protected in Quebec. Its implementation is phased, but September 2025 marks the deadline for its final and most demanding obligations. For SMBs, now is the time to act.
At S3, we’ve been helping our clients prepare. Here’s what your business needs to know.
What Is Law 25?
Law 25 updates Quebec’s private-sector privacy law to align more closely with global standards like the European GDPR. It imposes new obligations on any organization that collects, uses, or stores personal data.
It applies to all businesses operating in Quebec, regardless of size.
What’s Already in Effect (Since 2022–2023)
- Appointing a person responsible for personal data protection
- Notifying the CAI (Commission d’accès à l’information du Québec) and affected individuals in case of a privacy breach
- Maintaining a registry of incidents
- Deleting data that is no longer needed
- Publishing your privacy policies on your website
What Comes Into Force in September 2025
- Conducting Privacy Impact Assessments (PIAs) before collecting or sharing sensitive data
- Managing data transfers abroad with documented safeguards
- Allowing data portability (users can request their data in a readable format)
- Enabling the right to erasure (“right to be forgotten”)
- Documenting all internal policies and practices related to personal data
These requirements may sound technical, but they are crucial to avoid major penalties.
What Happens If You Don’t Comply?
Law 25 comes with serious consequences:
- Fines of up to $10 million or 2% of worldwide revenue for serious breaches
- Risk of lawsuits, including class actions for moral or punitive damages
The CAI (Commission d’accès à l’information du Québec) has already started conducting audits. Compliance is no longer optional.
What Should SMBs Do by 2025?
Here’s a simple roadmap to get compliant:
- Appoint a responsible person (usually a manager or IT partner)
- Inventory the personal data you collect and store
- Update your privacy policies (website, HR, marketing, etc.)
- Review contracts with vendors and partners (add data protection clauses)
- Train employees on data privacy best practices
- Set up an incident response process (for breaches, misdirected emails, etc.)
- Maintain clear documentation in case of an audit by the CAI
Need help getting compliant? Let’s talk.
