What Quebec Law 25 - Modernisation de la Loi sur la protection des renseignements personnels dans le secteur privé (2021) requires
Quebec Law 25 (Loi 25 - La Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) was enacted by the Assemblée nationale du Québec in September 2021 and amends both the Act respecting the protection of personal information in the private sector (Loi sur la protection des renseignements personnels dans le secteur privé, LPRPSP) and the Act respecting access to documents held by public bodies and the protection of personal information. Law 25 represents the most significant reform to Quebec's data protection framework since 1994 and introduces GDPR-equivalent obligations applicable to organisations processing personal data of Quebec residents. The law came into force in three successive phases: Phase 1 (22 September 2022) introduced mandatory privacy officer designation and incident reporting to the Commission d'accès à l'information (CAI); Phase 2 (22 September 2023) introduced rights of access, rectification, de-indexation, cessation of dissemination, and portability for individuals; and Phase 3 (22 September 2024) introduced privacy by default requirements. Key obligations include: designation of a Privacy Officer responsible for personal information protection; privacy impact assessments (PIAs) for personal information communicated outside Quebec; mandatory breach reporting to CAI within 72 hours and notification of affected individuals without delay; new consent requirements for sensitive information and for commercial prospecting; enhanced transparency requirements; the right to data portability; and administrative monetary penalties of up to $25,000,000 CAD or 4% of global annual turnover (whichever is greater). The Commission d'accès à l'information (CAI) is the regulatory authority. Quebec Law 25 applies in Quebec in addition to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and its successor legislation.
Pillar: Cybersecurity · Authority: Commission d'accès à l'information (CAI), Government of Quebec · Version: 1.0.0 · Last updated:
Primary source: https://www.cai.gouv.qc.ca
SHA-256 integrity: 296a248603ebcc5ab052b43b9199fedd96c8be73786763189080590754461d37
Primary Citations — 7 traced to source
- Quebec Law 25 - Loi modernisant des dispositions législatives en matière de protection des renseignements personnels, adopted September 2021, in force in phases from September 2022 to September 2024
- Act respecting the protection of personal information in the private sector (LPRPSP) as amended by Law 25 - primary statutory framework for private sector data protection in Quebec
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/ca-qc-law25-2023.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/ca-qc-law25-2023.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/ca-qc-law25-2023
- Back to registry: Browse all 10,108 compliance nodes