Quebec Law 25 Compliance
Quebec Law 25 (Bill 64) Privacy Compliance for Organizations Handling Quebec Data
Praxis-Q delivers Quebec Law 25 compliance for organizations that collect or process the personal information of Quebec residents - privacy governance, consent management, PIA/DPIA, breach response and cross-border transfer controls aligned to the CAI requirements.
Quebec Law 25
Quebec Law 25 Compliance
Quebec Law 25 (Bill 64) Privacy Compliance for Organizations Handling Quebec Data
The Problem
Quebec Law 25 is the strictest privacy law in Canada, with penalties up to $25M or 4% of worldwide turnover. Most organizations still lack the privacy officer, consent records and breach procedures it now requires.
What We Do
- Gap Assessment
- Governance
- Consent & Rights
- PIA & Transfers
- Breach Readiness
What You Get
- Gap assessment against all Law 25 obligations
- Privacy officer role and governance setup
- Consent and transparency mechanisms
- Privacy Impact Assessments (PIA/DPIA)
- Breach notification process to the CAI
- Cross-border transfer impact assessments
- Data retention and de-indexing rights
- Records of processing and policies
Why weeks, not months
AI-assisted evidence review, one client portal
Every Quebec Law 25 engagement runs on the Praxis-Q compliance platform. You upload evidence per control, AI scores it against the requirement, and your auditor reviews in the same workflow — from scoping through to the issued, publicly verifiable certificate.
AI evidence scoring
Every upload is scored against the control before an auditor sees it — gaps surface in minutes, not at the review meeting.
One client portal
Scoping, evidence, auditor queries and status live in one place. No email chains, no spreadsheet trackers.
Auditor sign-off
Praxis-Q auditors review inside the same workflow, so review rounds shrink and the certificate issues sooner.
Law 25's Three-Phase Rollout and Where Obligations Stand Now
Law 25 came into force in three tranches: September 2022 brought the mandatory privacy officer designation (by default the CEO, unless the role is delegated) and breach notification duties; September 2023 added consent requirements, privacy-by-default settings, and the rights to portability and de-indexing; September 2024 completed the rollout with the biometric information registration requirement and the remaining data portability provisions. Organisations that built their programme around only the September 2022 requirements are commonly missing two full years of subsequent obligations. Praxis-Q's gap assessment checks against all three phases explicitly rather than assuming an early compliance effort is still current.
Two Penalty Tracks: Administrative Monetary Penalties and Penal Offences
Law 25 created two distinct enforcement mechanisms that are often conflated. Administrative monetary penalties, issued directly by the CAI without a court process, run up to CAD 10 million dollars or 2% of worldwide turnover for the prior fiscal year, whichever is greater, for contraventions like inadequate consent mechanisms or missing PIAs. Penal offences - the more serious track, requiring prosecution - carry fines up to CAD 25 million dollars or 4% of worldwide turnover, reserved for matters like knowingly communicating personal information without consent or obstructing a CAI investigation. Praxis-Q's risk assessment flags which gaps expose an organisation to which track, since the response and remediation priority differ.
Privacy Impact Assessments for Transfers Outside Quebec
Law 25 requires a documented PIA before any communication of personal information outside Quebec, assessing whether the destination provides protection 'equivalent' to Quebec's regime - a materially different and, in places, stricter standard than GDPR's adequacy-decision model. This catches routine SaaS and cloud vendor relationships that organisations often don't think of as a 'transfer' at all: a Quebec entity using a US-hosted CRM or an offshore support team touching customer records needs a PIA on file for that relationship specifically. Praxis-Q builds the PIA methodology and works through the existing vendor list to identify which relationships need one retroactively.
The Privacy Officer Role and Governance Structure
By default, the person exercising the highest authority in the organisation (usually the CEO) is the privacy officer under Law 25 unless that function is formally delegated in writing - and delegation is the practical norm for anything beyond a very small organisation. The role carries real operational duties: approving PIAs, handling data subject requests, managing breach response, and being CAI's point of contact. Praxis-Q sets up the delegation documentation, defines the operating procedures the privacy officer needs, and can provide privacy-officer-as-a-service for organisations that need the function covered without a dedicated internal hire.
Aligning Law 25 with an Existing GDPR or PIPEDA Programme
Law 25 was deliberately modelled on GDPR, so organisations with an existing GDPR programme are closer to compliant than they realise - consent standards, breach notification concepts, and privacy-by-design principles carry across structurally. The gaps are specific: Law 25's transfer PIA standard, its biometric information registration requirement, and its de-indexing and portability rights don't have exact GDPR equivalents and need their own procedures. Praxis-Q builds on an existing GDPR or federal PIPEDA programme rather than starting a parallel Quebec-only compliance effort, mapping the genuine gaps rather than re-documenting what's already in place.