Privacy and governance: Quebec Law 25, PIPEDA and practical compliance
Understand your obligations, appoint the right people and put simple, documented practices in place, sized for your organization.
What Quebec's Law 25 actually requires
Phased in between September 2022 and September 2024, Law 25 modernized privacy protection in Quebec and is among the most demanding regimes in Canada. For an SMB, it is mostly about governance: knowing what personal information you hold, who is accountable and how it is protected.
For businesses in Ottawa and elsewhere in Ontario, PIPEDA sets the federal baseline. We help you understand which rules apply and put proportionate practices in place.
Key obligations under Law 25
- A designated person in charge of personal information, with title and contact details published
- Governance policies and practices for personal information
- A register of confidentiality incidents and notice to the Commission d'accès à l'information when there is a risk of serious injury
- Privacy impact assessments in certain situations, including transfers outside Quebec
- Clear consent and a privacy policy in plain language
- Destruction or anonymization once purposes are fulfilled
- Transparency for decisions based exclusively on automated processing
From obligation to everyday practice
Roles and accountability
Clarify who does what, from leadership to employees.
Personal information inventory
Map what you collect, where it is stored and who can access it.
Policies and registers
Practical templates to adapt: governance, incidents, retention and destruction.
Awareness
Train teams on good habits and incident reporting.
Under Law 25, administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%. Beyond the numbers, what is really at stake is your clients' trust.
Cyberallié is not a law firm. Our services are not legal advice and do not guarantee compliance, which depends on your actual practices and applicable obligations.
Privacy questions
We're in Ontario. Which privacy law applies to us?
Private-sector commercial activities in Ontario are generally governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA). If you collect personal information from Quebec residents or operate in Quebec, Quebec's private-sector privacy law, modernized by Law 25, may also apply.
Can Cyberallié guarantee our compliance?
No, and nobody should promise that. We help you understand your obligations and put appropriate practices in place. For legal interpretation, consult a lawyer.
What about the new federal cybersecurity law?
Bill C-8, which received Royal Assent in June 2026, enacts the Critical Cyber Systems Protection Act. It primarily targets designated operators in federally regulated critical sectors (finance, energy, telecommunications, transportation). Most SMBs are not directly covered, but regulated clients may pass requirements down to their suppliers.
Start with a clear picture of where you stand.
In 90 minutes, the Cyber & AI Assessment gives you your five concrete priorities. No jargon, no obligation.