Quebec Law 25 & PIPEDA Compliance
Quebec Law 25 and PIPEDA are the two privacy laws that govern how Canadian businesses collect, use, store, and protect personal information. Law 25 (formerly Bill 64) applies to organizations operating in Quebec, while PIPEDA is the federal standard for private-sector data handling across the rest of Canada. Together they set rules for consent, breach reporting, data retention, and accountability. Non-compliance can trigger penalties reaching millions of dollars, making a structured privacy program essential for any business that touches customer or employee data.
Why privacy compliance now matters for every Canadian business
Privacy regulation in Canada has shifted from a back-office formality to a board-level risk. Quebec's Law 25 introduced some of the strictest private-sector privacy rules in North America, phased in between 2022 and 2024, while PIPEDA continues to govern interprovincial and federal commerce. Customers, partners, and insurers increasingly ask businesses to prove how they safeguard personal data.
The practical effect is that even small firms now need documented processes for the following:
- Consent: clear, specific permission before collecting personal information.
- Transparency: a plain-language privacy policy explaining what you collect and why.
- Security: reasonable technical and organizational safeguards against breaches.
- Accountability: a named person responsible for privacy and a record of decisions.
Treating compliance as an IT and governance project, rather than a one-time legal sign-off, is what keeps an organization defensible if a regulator or customer ever asks questions.
What Quebec Law 25 requires
Law 25 modernized Quebec's private-sector privacy regime and added obligations that go beyond older Canadian rules. Key requirements include appointing a person in charge of the protection of personal information (the privacy officer role defaults to the most senior executive unless delegated in writing), conducting privacy impact assessments before certain projects, and reporting confidentiality incidents that pose a risk of serious injury to the Commission d'accès à l'information (CAI) and affected individuals.
Other notable provisions cover:
- Consent by default: privacy settings on technology must default to the most protective option.
- Data portability: individuals can request their data in a structured, commonly used format.
- Right to deletion: people can ask you to stop disseminating or de-index personal information in defined circumstances.
- Cross-border transfers: assessments are required before sending personal data outside Quebec.
These obligations apply regardless of company size, so a two-person clinic faces many of the same baseline duties as a large enterprise.
What PIPEDA requires across Canada
The Personal Information Protection and Electronic Documents Act (PIPEDA) is the federal law for organizations engaged in commercial activity outside Quebec, Alberta, and British Columbia, which have their own substantially similar laws. PIPEDA is built around ten fair information principles, including accountability, identifying purposes, consent, limiting collection, accuracy, safeguards, openness, individual access, and challenging compliance.
For most businesses, PIPEDA compliance means you must:
- Obtain meaningful consent for collecting and using personal information.
- Limit collection to what is necessary for an identified purpose.
- Protect data with safeguards appropriate to its sensitivity.
- Report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada (OPC) and affected individuals, and keep records of all breaches.
A Quebec business serving customers nationally often has to satisfy both Law 25 and PIPEDA at once, which is why a unified privacy framework saves time and reduces gaps.
How Law 25 and PIPEDA work together
Many Canadian organizations are subject to both regimes, and the laws overlap more than they conflict. Where they differ, the safest approach is to design controls to the stricter standard, which is usually Law 25. For example, Law 25's breach-reporting threshold and documentation expectations are more prescriptive than PIPEDA's, so a process built for Quebec generally satisfies the federal rule too.
A practical way to harmonize the two is to build one privacy program that maps each control to both laws:
- One consent model that meets Law 25's default-protection rule and PIPEDA's meaningful-consent test.
- One breach playbook that notifies the CAI, the OPC, and individuals on the tightest timeline.
- One records framework covering data inventory, retention schedules, and impact assessments.
This reduces duplicated effort and keeps your documentation consistent if you are ever audited under either statute.
Building a compliant IT and data program
Privacy compliance ultimately depends on how your systems are configured, not just on policy documents. The technical foundation usually includes access controls so only authorized staff reach personal information, encryption for data at rest and in transit, monitored backups, endpoint protection, and logging that lets you reconstruct who accessed what and when. These same controls are what regulators expect to see when they assess whether your safeguards were reasonable.
A managed IT and cybersecurity partner can operationalize the requirements by maintaining a current data inventory, hardening systems, running breach-response drills, and keeping evidence that controls are working. For Quebec and Canadian businesses that lack a dedicated privacy and security team, outsourcing this work is often faster and more reliable than building it in-house, and it ensures the technical side of Law 25 and PIPEDA is handled by specialists rather than left to chance.
FAQ
Does my business need to comply with both Law 25 and PIPEDA?
If you operate in Quebec, Law 25 applies. If you also handle personal information in commercial activity across provincial or national borders, PIPEDA likely applies too. Many Canadian businesses meet both at once, so building one program to the stricter Law 25 standard is usually the most efficient approach.
What is the difference between the CAI and the OPC?
The Commission d'accès à l'information (CAI) enforces Quebec's Law 25, while the Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA federally. Depending on your operations, you may need to report breaches and answer to one or both regulators.
How quickly do I need to report a data breach?
Both laws require notifying the relevant regulator and affected individuals without unreasonable delay once you determine a breach poses a risk of serious injury or significant harm. There is no fixed hour count, but documentation and prompt action are expected, so a prepared breach playbook is essential.
Is privacy compliance only about legal documents?
No. Policies matter, but regulators assess whether your actual technical and organizational safeguards are reasonable. Access controls, encryption, monitored backups, and breach-response capability are central, which is why compliance is as much an IT project as a legal one.
Prefer done-for-you?
This series teaches the DIY path. If you'd rather have a team handle it, IT Cares — hands-on managed IT across Canada serves businesses across Canada.