How ready is your organisation for Quebec's Law 25?
Law 25 reshaped how any organisation handling the personal information of Quebec residents has to operate. This two-minute check gives you an honest readiness tier across the obligations the Commission d'accès à l'information cares about most, plus the three moves that close your biggest gap.
- 6 questions
- About 2 minutes
- Report by email
Quebec Law 25 readiness assessment
Quick context
What is Quebec's Law 25?
Law 25 is Quebec's modernised privacy law, formerly Bill 64, which amended the Act respecting the protection of personal information in the private sector. It rolled out in three phases on 22 September 2022, 2023, and 2024. It strengthens consent, incident reporting, privacy assessments, and individual rights, with the Commission d'accès à l'information as the regulator.
Who must comply with Law 25?
Any private-sector organisation that collects, holds, uses, or shares the personal information of people in Quebec, regardless of where the organisation is based. It applies more broadly than the federal PIPEDA, so national and out-of-province companies serving Quebec residents are usually in scope.
What are the penalties under Law 25?
Law 25 carries two tracks. The CAI can issue administrative monetary penalties up to $10 million or 2% of worldwide turnover, whichever is greater. Penal fines through the courts reach up to $25 million or 4% of worldwide turnover. Individuals also have a private right of action.
Who closes the gaps this finds?
We do. This assessment scores where you stand against the framework, and stops there. The next step is the engagement behind that score: what we audit, what we build, and who runs it. Start there if you would rather have the gaps closed than catalogued.
