Quebec Law 25 Posture Guide

Quebec’s Act respecting the protection of personal information in the private sector, as overhauled by Law 25 (adopted as Bill 64 in 2021), is the strictest private-sector privacy regime in Canada. If you message or call recipients in Quebec, it applies on top of — not instead of — the federal PIPEDA posture: a tenant operating a Canadian deployment routinely answers to both regimes on the same record, and Law 25 is the harder of the two on nearly every axis.

Everything below is a tenant-owned control. Orbit ships the surfaces — the consent ledger, the DSAR workflow, retention settings, the breach incident register, the privacy register — defaults-open; your organization configures them for Quebec. Law 25 compliance remains your responsibility, and the Commission d’accès à l’information (CAI) enforces it regardless of what any toggle says. This page is documentation, not legal advice — have counsel decide whether your enterprise carries on business in Quebec and therefore falls within the Act.

1. Scope — who Law 25 reaches

Private enterprises doing business in Quebec. The Act binds any private enterprise that collects, holds, uses, or communicates personal information in the course of carrying on business in Quebec — head office location is not the test. A tenant whose contact base includes Quebec residents is the archetypal addressee.
You determine applicability. Whether your activity amounts to “carrying on business in Quebec” is a legal classification your counsel makes; Orbit never makes it, and nothing on this page gates sending on the answer.
Public bodies are outside this Act. They answer to the parallel public-sector statute; sectoral regimes (health, financial services) layer on top of the private-sector Act rather than replacing it.
PIPEDA runs concurrently. Inter-provincial or international transfers of personal information also engage PIPEDA, so one Quebec record can sit under both statutes at once. The federal mapping lives in the Canada PIPEDA Posture Guide; this page covers only what Law 25 adds.

2. How Law 25 differs from PIPEDA

PIPEDA states principles; Law 25 states duties with teeth. The material differences a Canadian reviewer tests:

Duty	Law 25	PIPEDA counterpart
Privacy officer	A designated privacy officer is mandatory — the person with the highest authority in the enterprise holds the role by default and may delegate duties in writing; the officer’s title and contact information must be published.	Accountability is a principle with no statutory officer, no delegation form, and no publication duty.
Privacy impact assessments (PIA)	Mandatory for any project involving an information system that handles personal information, and before communicating personal information outside Quebec (with an adequate-protection assessment of the destination).	No statutory PIA; safeguards are assessed after the fact.
Automated-decision transparency	When a decision about a person is based solely on automated processing, you must disclose, on request, that fact, the personal information used, the reasons, and the person’s right to make representations and have the record corrected — and describe the use of automated decision-making in your privacy notice.	No equivalent right.
Proportionality of collection	Collection is limited to what is necessary for the stated, specific purposes — a proportionality test, not just a limiting-collection principle.	Limiting collection, read as reasonable rather than necessary.
Enhanced consent	Consent must be manifest, free, informed, and specific, in clear, simple language; for sensitive information, consent must be express.	Meaningful consent, sensitivity-scaled, without the express-consent rule.
Data portability	Since September 2024, the right to receive one’s personal information in a structured, commonly used format and, where technically feasible, to have it transferred to another holder.	No portability right.
Breach register	A register of every confidentiality incident; notification to the CAI and to affected persons where the incident poses a risk of serious harm.	A 24-month record of every breach and OPC Report at the RROSH threshold — similar shape, different regulator and threshold vocabulary.
Retention schedule	Personal information no longer needed for the purposes must be destroyed or anonymized, on a demonstrable schedule.	Limiting retention, without the destruction/anonymization posture.
Privacy by default	Since September 2023, the default settings of any new system or technology you deploy must be set to the highest level of confidentiality.	No equivalent duty.
Penalties	Administrative monetary penalties to CAD 10M or 2% of worldwide turnover; penal offences to CAD 25M or 4% of worldwide turnover.	OPC findings and a record-keeping fine; no AMP regime of this scale.

3. The CAI — your supervising regulator

The Commission d’accès à l’information (CAI) supervises the Act: it audits, orders, and levies the monetary administrative penalties above. Everything you owe the CAI — the confidentiality-incident notification, the PIA evidence for an outside-Quebec transfer, the answer to an access complaint — leaves through your legal channels. Orbit records and attests; it never files with the CAI on your behalf. Where the PIPEDA guide routes a Report to the OPC, this regime routes the parallel filing to the CAI, and a cross-border contact base (Ontario → Quebec recipients in one incident) can owe both in the same week.

4. Tenant-owned controls mapped to each duty

Law 25 duty	Orbit control	Deep page
Privacy officer + delegation	Record the designation — and any written delegation — where your officer designations live: the DPO & representative surface holds the name and contact and exports a binder-ready attestation statement. Publish the officer’s title and contact in the privacy notice itself; the publication duty is yours.	DPO & EU/UK Representative Designation
Access, erasure, portability (DSAR)	File Quebec requests with `applicable_jurisdiction: "pipeda"` — its 30-day tracker matches Law 25’s 30-day access window — and state the Law 25 basis in `requester_statement`; the `portability` verb produces the machine-readable export the portability right demands, and a completed `delete` flows into suppression so the erased contact does not re-enter sends.	Data Subject Access Requests (DSAR)
Privacy impact assessments	Keep the privacy register as the PIA-adjacent standing record: each activity’s purpose, lawful basis, jurisdictions, and retention window is the inventory a PIA starts from, and the register’s outside-Quebec transfer entries are the ones that need a completed assessment before the transfer runs. Roll completed assessments into the evidence binder.	Privacy Register, Compliance evidence binder
Automated-decision transparency	Inventory every solely-automated decision in the privacy register, write the notice disclosure and the on-request answer (information used, reasons, representation rights) as tenant-owned content, and fulfil correction requests through the DSAR `correct` verb.	Privacy Register, DSAR
Enhanced + express consent	`POST /compliance/consent` records the per-channel opt-in with `purpose`, `consent_text_version`, and `consent_proof_url`; capture express consent rows for sensitive categories and keep the French version as its own versioned text. The unknown-consent default policy can refuse traffic until a row exists — a tenant setting, not a platform default.	Consent Management, Consent default policy
Breach register + CAI notification	Open every confidentiality incident in the breach incident register the moment you detect it; where the risk-of-serious-harm threshold is met, file the CAI notification and the individual notices yourself, then stamp the register with `party: "supervisory_authority"` and the CAI reference so the register is your complete incident record.	Breach incident register
Retention schedule	Per-domain retention windows under the retention policy are the demonstrable destruction/anonymization schedule the Act asks for.	Data Retention Policy
Outside-Quebec transfers + residency	Pin the data classes your Quebec cohort generates to the geography your PIA assessed, and document the residency answer per class before any transfer configuration changes.	Data Residency Overview
Privacy by default	Orbit ships defaults-open; a Law 25 tenant tightens. Set the tenant postures the duty points at — consent default policy, retention windows, disclosure surfaces — to the highest-confidentiality setting for the systems you configure.	Consent default policy

Worked sequence — a portability request from Quebec. A Quebec resident asks for their information in a portable format. File it from the first call with the Law 25 basis on the record:

curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "subject_email": "camille@example.qc.ca",
    "requester_email": "privacy@yourcompany.ca",
    "applicable_jurisdiction": "pipeda",
    "request_type": "portability",
    "requester_statement": "Quebec resident requested a structured, portable copy of their personal information under the Law 25 portability right; identity verified by support. The 30-day clock applies."
  }'

The SLA tracker applies the 30-day window, the export the pipeline produces is the structured copy you hand over, and the completed request closes with its certificate in the evidence binder.

5. French-language considerations

The Charter of the French Language requires your Quebec-facing privacy notices, consent wording, and consumer communications to be available in French — and in practice to lead in French. Every word Orbit sends on your behalf is tenant-owned template content: the consent texts held version-by-version in the consent ledger, the preference-center copy, and your message templates. Author the French versions first, keep them as their own versioned texts, and treat a notice that exists only in English as an open Law 25 and Charter finding at once. Orbit carries your wording in either language; producing the wording is yours.

6. Runbook — the first 60 days on Orbit

Days 1–14 — accountability.

With counsel, decide applicability: do you carry on business in Quebec?
Designate the privacy officer (or delegate in writing from the highest authority), record the designation on the DPO & representative surface, and publish the title and contact in the privacy notice.
Open the privacy register and enumerate every processing activity that touches Quebec residents — purpose, basis, jurisdictions, retention.

Days 15–30 — consent and defaults.

Audit consent capture against manifest/informed/specific; add express-consent rows for sensitive categories, French text versioned alongside.
Set the unknown-consent default policy for Quebec-bound traffic until every row exists.
Review the systems you configure for the privacy-by-default duty; tighten tenant settings accordingly.

Days 31–45 — assessments and residency.

Run a PIA for each information system the register surfaced; complete an assessment for every outside-Quebec communication before the transfer continues, and pin residency for the Quebec cohort where the assessment demands it.
Set per-domain retention windows; schedule destruction or anonymization at purpose-end.

Days 46–60 — incidents and rights.

Connect the breach incident register to your detection path; draft the CAI notification and individual-notice templates so a risk-of-serious-harm incident is a stamping exercise, not a drafting exercise.
Drill one access, one erasure, and one portability request end-to-end through the DSAR surface and confirm the 30-day tracker, the export, and the suppression feed all behave.
Roll register, attestations, and completed PIAs into the evidence binder and set the quarterly review cadence.

7. Legal-review callout

Before you rely on this page, have counsel review three moving parts: sectoral exclusions — public bodies and certain sector-regulated enterprises (health, financial services) follow parallel or layered statutes; employment collections — the rules governing employee and candidate personal information phased in across 2023–2025 and carry their own necessity test; and provisions effective as of October 2026 — the Act staged its entry into force from 2022 through 2024 and amendments and CAI guidance keep landing, so confirm against the current text what is in force on the date you read this. This page maps the posture; it does not state the law as of any date.

Frequently asked questions

Does a completed PIPEDA posture give me Law 25 compliance? No. PIPEDA’s principles cover part of the ground, but the privacy officer, the statutory PIA, automated-decision transparency, portability, privacy by default, and the French-language duties are Law 25 additions with no federal counterpart. Which DSAR clock does a Quebec request carry? 30 days. File or reclassify with applicable_jurisdiction: "pipeda" so the SLA tracker applies the matching window, and state the Law 25 basis in requester_statement. Does Orbit report to the CAI for me? No. The register records the incident and stamps your notification with its timestamp; the CAI filing and the individual notices leave through your legal channels. Is the privacy officer duty satisfiable by delegation? Yes — in writing. The highest authority in the enterprise remains accountable; record the delegation with the designation and publish the officer’s title and contact in the notice.

Canada PIPEDA Posture Guide — the federal regime this page runs alongside.
Data Subject Access Requests (DSAR) — the access/erasure/portability surface and its 30-day clocks.
Breach incident register — the incident record and notification stamps.
Privacy Register — the processing-activity inventory a PIA starts from.
Consent Management and Consent default policy — the enhanced-consent pair.
Data Retention Policy and Data Residency Overview — the retention and transfer pair.
DPO & EU/UK Representative Designation — the officer-designation record and attestation.
CASL (Canada’s Anti-Spam Legislation) — the separate CRTC-enforced anti-spam regime for dispatch.

Getting Started

Channels

Channels (Voice)

AI Agents

Campaigns

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Brand & press

Changelog

Quebec Law 25 Posture Guide

Quebec Law 25 Posture Guide

1. Scope — who Law 25 reaches

2. How Law 25 differs from PIPEDA

3. The CAI — your supervising regulator

4. Tenant-owned controls mapped to each duty

5. French-language considerations

6. Runbook — the first 60 days on Orbit

7. Legal-review callout

Frequently asked questions

​Quebec Law 25 Posture Guide

​1. Scope — who Law 25 reaches

​2. How Law 25 differs from PIPEDA

​3. The CAI — your supervising regulator

​4. Tenant-owned controls mapped to each duty

​5. French-language considerations

​6. Runbook — the first 60 days on Orbit

​7. Legal-review callout

​Frequently asked questions

​Related references

Quebec Law 25 Posture Guide

1. Scope — who Law 25 reaches

2. How Law 25 differs from PIPEDA

3. The CAI — your supervising regulator

4. Tenant-owned controls mapped to each duty

5. French-language considerations

6. Runbook — the first 60 days on Orbit

7. Legal-review callout

Frequently asked questions

Related references