> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Quebec Law 25 Posture Guide
> Map Quebec's Law 25 — the privacy officer, privacy impact assessments, automated-decision transparency, privacy by default, data portability, breach register, and monetary penalties — onto the consent ledger, DSAR pipeline, retention, residency, and privacy register you configure on Orbit, alongside the federal PIPEDA posture.
# Quebec Law 25 Posture Guide
Quebec's **Act respecting the protection of personal information in
the private sector**, as overhauled by **Law 25** (adopted as Bill 64
in 2021), is the strictest private-sector privacy regime in Canada.
If you message or call recipients in Quebec, it applies on top of —
not instead of — the federal
[PIPEDA posture](/compliance/pipeda-canada): a tenant operating a
Canadian deployment routinely answers to both regimes on the same
record, and Law 25 is the harder of the two on nearly every axis.
Everything below is a **tenant-owned control**. Orbit ships the
surfaces — the consent ledger, the DSAR workflow, retention
settings, the breach incident register, the privacy register —
defaults-open; your organization configures them for Quebec. Law 25
compliance remains your responsibility, and the Commission
d'accès à l'information (CAI) enforces it regardless of what any
toggle says. This page is documentation, **not legal advice** —
have counsel decide whether your enterprise carries on business
in Quebec and therefore falls within the Act.
***
## 1. Scope — who Law 25 reaches
* **Private enterprises doing business in Quebec.** The Act binds
any private enterprise that collects, holds, uses, or
communicates personal information in the course of carrying on
business in Quebec — head office location is not the test. A
tenant whose contact base includes Quebec residents is the
archetypal addressee.
* **You determine applicability.** Whether your activity amounts
to "carrying on business in Quebec" is a legal classification
your counsel makes; Orbit never makes it, and nothing on this
page gates sending on the answer.
* **Public bodies are outside this Act.** They answer to the
parallel public-sector statute; sectoral regimes (health,
financial services) layer on top of the private-sector Act
rather than replacing it.
* **PIPEDA runs concurrently.** Inter-provincial or international
transfers of personal information also engage PIPEDA, so one
Quebec record can sit under both statutes at once. The federal
mapping lives in the
[Canada PIPEDA Posture Guide](/compliance/pipeda-canada); this
page covers only what Law 25 adds.
***
## 2. How Law 25 differs from PIPEDA
PIPEDA states principles; Law 25 states duties with teeth. The
material differences a Canadian reviewer tests:
| Duty | Law 25 | PIPEDA counterpart |
| - | - | - |
| **Privacy officer** | A designated privacy officer is mandatory — the person with the highest authority in the enterprise holds the role by default and may delegate duties **in writing**; the officer's title and contact information must be published. | Accountability is a principle with no statutory officer, no delegation form, and no publication duty. |
| **Privacy impact assessments (PIA)** | Mandatory for any project involving an information system that handles personal information, and **before communicating personal information outside Quebec** (with an adequate-protection assessment of the destination). | No statutory PIA; safeguards are assessed after the fact. |
| **Automated-decision transparency** | When a decision about a person is based solely on automated processing, you must disclose, on request, that fact, the personal information used, the reasons, and the person's right to make representations and have the record corrected — and describe the use of automated decision-making in your privacy notice. | No equivalent right. |
| **Proportionality of collection** | Collection is limited to what is **necessary** for the stated, specific purposes — a proportionality test, not just a limiting-collection principle. | Limiting collection, read as reasonable rather than necessary. |
| **Enhanced consent** | Consent must be manifest, free, informed, and specific, in clear, simple language; for **sensitive** information, consent must be express. | Meaningful consent, sensitivity-scaled, without the express-consent rule. |
| **Data portability** | Since September 2024, the right to receive one's personal information in a structured, commonly used format and, where technically feasible, to have it transferred to another holder. | No portability right. |
| **Breach register** | A register of **every** confidentiality incident; notification to the CAI and to affected persons where the incident poses a **risk of serious harm**. | A 24-month record of every breach and OPC Report at the RROSH threshold — similar shape, different regulator and threshold vocabulary. |
| **Retention schedule** | Personal information no longer needed for the purposes must be destroyed or anonymized, on a demonstrable schedule. | Limiting retention, without the destruction/anonymization posture. |
| **Privacy by default** | Since September 2023, the default settings of any new system or technology you deploy must be set to the **highest level of confidentiality**. | No equivalent duty. |
| **Penalties** | Administrative monetary penalties to CAD 10M or 2% of worldwide turnover; penal offences to **CAD 25M or 4%** of worldwide turnover. | OPC findings and a record-keeping fine; no AMP regime of this scale. |
***
## 3. The CAI — your supervising regulator
The **Commission d'accès à l'information (CAI)** supervises the Act:
it audits, orders, and levies the monetary administrative penalties
above. Everything you owe the CAI — the confidentiality-incident
notification, the PIA evidence for an outside-Quebec transfer, the
answer to an access complaint — leaves through **your** legal
channels. Orbit records and attests; it never files with the CAI on
your behalf. Where the PIPEDA guide routes a Report to the OPC, this
regime routes the parallel filing to the CAI, and a cross-border
contact base (Ontario → Quebec recipients in one incident) can owe
both in the same week.
***
## 4. Tenant-owned controls mapped to each duty
| Law 25 duty | Orbit control | Deep page |
| - | - | - |
| **Privacy officer + delegation** | Record the designation — and any written delegation — where your officer designations live: the DPO & representative surface holds the name and contact and exports a binder-ready attestation statement. Publish the officer's title and contact in the privacy notice itself; the publication duty is yours. | [DPO & EU/UK Representative Designation](/compliance/dpo-representative) |
| **Access, erasure, portability (DSAR)** | File Quebec requests with `applicable_jurisdiction: "pipeda"` — its 30-day tracker matches Law 25's 30-day access window — and state the Law 25 basis in `requester_statement`; the `portability` verb produces the machine-readable export the portability right demands, and a completed `delete` flows into suppression so the erased contact does not re-enter sends. | [Data Subject Access Requests (DSAR)](/compliance/dsar) |
| **Privacy impact assessments** | Keep the [privacy register](/compliance/privacy-register) as the PIA-adjacent standing record: each activity's purpose, lawful basis, jurisdictions, and retention window is the inventory a PIA starts from, and the register's outside-Quebec transfer entries are the ones that need a completed assessment before the transfer runs. Roll completed assessments into the evidence binder. | [Privacy Register](/compliance/privacy-register), [Compliance evidence binder](/compliance/evidence-binder) |
| **Automated-decision transparency** | Inventory every solely-automated decision in the privacy register, write the notice disclosure and the on-request answer (information used, reasons, representation rights) as tenant-owned content, and fulfil correction requests through the DSAR `correct` verb. | [Privacy Register](/compliance/privacy-register), [DSAR](/compliance/dsar) |
| **Enhanced + express consent** | `POST /compliance/consent` records the per-channel opt-in with `purpose`, `consent_text_version`, and `consent_proof_url`; capture express consent rows for sensitive categories and keep the French version as its own versioned text. The unknown-consent default policy can refuse traffic until a row exists — a tenant setting, not a platform default. | [Consent Management](/compliance/consent-management), [Consent default policy](/compliance/consent-default-policy) |
| **Breach register + CAI notification** | Open every confidentiality incident in the breach incident register the moment you detect it; where the risk-of-serious-harm threshold is met, file the CAI notification and the individual notices yourself, then stamp the register with `party: "supervisory_authority"` and the CAI reference so the register is your complete incident record. | [Breach incident register](/compliance/breach-incident-register) |
| **Retention schedule** | Per-domain retention windows under the retention policy are the demonstrable destruction/anonymization schedule the Act asks for. | [Data Retention Policy](/compliance/data-retention-policy) |
| **Outside-Quebec transfers + residency** | Pin the data classes your Quebec cohort generates to the geography your PIA assessed, and document the residency answer per class before any transfer configuration changes. | [Data Residency Overview](/compliance/data-residency-overview) |
| **Privacy by default** | Orbit ships defaults-open; a Law 25 tenant tightens. Set the tenant postures the duty points at — consent default policy, retention windows, disclosure surfaces — to the highest-confidentiality setting for the systems you configure. | [Consent default policy](/compliance/consent-default-policy) |
**Worked sequence — a portability request from Quebec.** A Quebec
resident asks for their information in a portable format. File it
from the first call with the Law 25 basis on the record:
```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \
-H "X-API-Key: dv_live_sk_..." \
-H "Content-Type: application/json" \
-d '{
"subject_email": "camille@example.qc.ca",
"requester_email": "privacy@yourcompany.ca",
"applicable_jurisdiction": "pipeda",
"request_type": "portability",
"requester_statement": "Quebec resident requested a structured, portable copy of their personal information under the Law 25 portability right; identity verified by support. The 30-day clock applies."
}'
```
The SLA tracker applies the 30-day window, the export the pipeline
produces is the structured copy you hand over, and the completed
request closes with its certificate in the evidence binder.
***
## 5. French-language considerations
The **Charter of the French Language** requires your Quebec-facing
privacy notices, consent wording, and consumer communications to be
available in French — and in practice to lead in French. Every word
Orbit sends on your behalf is tenant-owned template content: the
consent texts held version-by-version in the consent ledger, the
preference-center copy, and your message templates. Author the
French versions first, keep them as their own versioned texts, and
treat a notice that exists only in English as an open Law 25 and
Charter finding at once. Orbit carries your wording in either
language; producing the wording is yours.
***
## 6. Runbook — the first 60 days on Orbit
**Days 1–14 — accountability.**
1. With counsel, decide applicability: do you carry on business in
Quebec?
2. Designate the privacy officer (or delegate in writing from the
highest authority), record the designation on the DPO &
representative surface, and publish the title and contact in the
privacy notice.
3. Open the privacy register and enumerate every processing
activity that touches Quebec residents — purpose, basis,
jurisdictions, retention.
**Days 15–30 — consent and defaults.**
4. Audit consent capture against manifest/informed/specific; add
express-consent rows for sensitive categories, French text
versioned alongside.
5. Set the unknown-consent default policy for Quebec-bound traffic
until every row exists.
6. Review the systems you configure for the privacy-by-default
duty; tighten tenant settings accordingly.
**Days 31–45 — assessments and residency.**
7. Run a PIA for each information system the register surfaced;
complete an assessment for every outside-Quebec communication
before the transfer continues, and pin residency for the Quebec
cohort where the assessment demands it.
8. Set per-domain retention windows; schedule destruction or
anonymization at purpose-end.
**Days 46–60 — incidents and rights.**
9. Connect the breach incident register to your detection path;
draft the CAI notification and individual-notice templates so a
risk-of-serious-harm incident is a stamping exercise, not a
drafting exercise.
10. Drill one access, one erasure, and one portability request
end-to-end through the DSAR surface and confirm the 30-day
tracker, the export, and the suppression feed all behave.
11. Roll register, attestations, and completed PIAs into the
evidence binder and set the quarterly review cadence.
***
## 7. Legal-review callout
Before you rely on this page, have counsel review three moving
parts: **sectoral exclusions** — public bodies and certain
sector-regulated enterprises (health, financial services) follow
parallel or layered statutes; **employment collections** — the
rules governing employee and candidate personal information
phased in across 2023–2025 and carry their own necessity test;
and **provisions effective as of October 2026** — the Act staged
its entry into force from 2022 through 2024 and amendments and CAI
guidance keep landing, so confirm against the current text what
is in force on the date you read this. This page maps the posture;
it does not state the law as of any date.
***
## Frequently asked questions
**Does a completed PIPEDA posture give me Law 25 compliance?**
No. PIPEDA's principles cover part of the ground, but the privacy
officer, the statutory PIA, automated-decision transparency,
portability, privacy by default, and the French-language duties are
Law 25 additions with no federal counterpart.
**Which DSAR clock does a Quebec request carry?**
30 days. File or reclassify with
`applicable_jurisdiction: "pipeda"` so the SLA tracker applies the
matching window, and state the Law 25 basis in
`requester_statement`.
**Does Orbit report to the CAI for me?**
No. The register records the incident and stamps your notification
with its timestamp; the CAI filing and the individual notices leave
through your legal channels.
**Is the privacy officer duty satisfiable by delegation?**
Yes — in writing. The highest authority in the enterprise remains
accountable; record the delegation with the designation and publish
the officer's title and contact in the notice.
***
## Related references
* [Canada PIPEDA Posture Guide](/compliance/pipeda-canada) — the
federal regime this page runs alongside.
* [Data Subject Access Requests (DSAR)](/compliance/dsar) — the
access/erasure/portability surface and its 30-day clocks.
* [Breach incident register](/compliance/breach-incident-register) —
the incident record and notification stamps.
* [Privacy Register](/compliance/privacy-register) — the
processing-activity inventory a PIA starts from.
* [Consent Management](/compliance/consent-management) and
[Consent default policy](/compliance/consent-default-policy) —
the enhanced-consent pair.
* [Data Retention Policy](/compliance/data-retention-policy) and
[Data Residency Overview](/compliance/data-residency-overview) —
the retention and transfer pair.
* [DPO & EU/UK Representative Designation](/compliance/dpo-representative) —
the officer-designation record and attestation.
* [CASL (Canada's Anti-Spam Legislation)](/compliance/casl-canada-anti-spam) —
the separate CRTC-enforced anti-spam regime for dispatch.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.