Complying with privacy legislation in Quebec: essential guide
The legal framework
Businesses in Quebec are subject to the Act respecting the protection of personal information in the private sector, extensively amended by Law 25 (2021), with obligations phased in between 2022 and 2024. Federally regulated businesses and interprovincial transfers are subject to PIPEDA.
Main obligations
- designate a person in charge of the protection of personal information (by default, the CEO) and publish their contact details;
- adopt and publish governance policies and practices and a privacy policy in clear terms;
- obtain consent that is manifest, free, enlightened and given for specific purposes; express consent for sensitive information;
- conduct a privacy impact assessment for any project involving personal information systems and before communicating information outside Quebec;
- offer the highest level of confidentiality by default for technological products and services;
- report confidentiality incidents presenting a risk of serious injury and keep a register;
- respect rights of access, rectification, de-indexing and, since 2024, data portability;
- inform people of automated decisions and of the use of tracking or profiling technologies.
Penalties
Administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%, as well as a private right of action with punitive damages for intentional or grossly negligent breaches.
