Quebec's Law 25: What Ontario & GTA Businesses Serving Quebec Customers Need to Know

Law 25 (adopted in Quebec in 2021, with obligations phased in between 2022 and 2024) modernized Quebec's private-sector privacy rules. It applies to organizations that collect, hold, or use the personal information of people in Quebec, which can include an Ontario business with Quebec customers, an e-commerce store shipping to Montreal, or a service provider whose client base crosses the provincial border.

Law 25 adds four obligations that land on IT as much as on legal. Each is covered below.

Every organization subject to the law must designate someone responsible for the protection of personal information and publish that person's title and contact information. By default this is the highest-ranking officer.

When a confidentiality incident, a breach, loss, or unauthorized access, presents a risk of serious injury, the organization must notify Quebec's privacy regulator (the Commission d'accès à l'information) and the affected individuals, and must keep a register of all incidents. That means you need to be able to detect incidents in the first place, which is where monitoring and managed detection and response earn their keep.

Law 25 requires privacy impact assessments in defined situations, including when personal information is communicated outside Quebec. If your systems, backups, or cloud services store Quebec customers' data in other provinces or countries, that transfer is something your compliance program has to account for.

The law tightens consent requirements, requires clear privacy policies, and gives individuals rights over their information, including deletion (de-indexing) and, since 2024, data portability. Practically, your business needs to know what personal data it holds, where it lives, and how to retrieve or delete it on request. That is a data-inventory and systems question as much as a legal one.

Law 25 carries administrative monetary penalties and, for serious offences, fines that can reach the greater of $25 million or 4% of worldwide turnover. Enforcement is real, and 'we didn't know the law applied to us' is not a defence.

A privacy program is policy plus technology. The technical controls that support Law 25 readiness are largely the same ones that support PIPEDA and good security generally: knowing where personal data is stored (data mapping), encryption at rest and in transit, access controls and multi-factor authentication so only authorized people touch personal information, monitoring and managed detection and response so a confidentiality incident is detected and documented quickly, tested backups with a known storage location, and retention and deletion processes that can actually honour an individual's request.

If you serve Quebec customers, being able to respond to privacy requests and support issues in French is a practical requirement of doing business there, beyond what any statute says. When choosing vendors and support partners, it is worth asking how French-language requests will be handled end to end.

• Confirm with counsel whether Law 25 applies to your operations. 2. Inventory the personal information you hold and where it is stored, including cloud services and backups. 3. Close the technical gaps: encryption, MFA, access controls, detection, tested backups. 4. Document incidents and be ready to report. 5. Review the same controls against PIPEDA, since both regimes will usually apply to an Ontario business.

IT Rapid Support provides the technical foundation that privacy compliance programs are built on for businesses across Toronto and the GTA: data protection, access management, encrypted and tested backups, and 24/7 managed detection and response that helps you detect and document incidents. We work alongside your legal and privacy advisors: they define the obligations, we implement the controls. Call (289) 582-9930 to review where your systems stand.