Quebec Law 25
Quebec Law 25 compliance for incidents and IT projects
Incident registry design, privacy impact assessments for IT projects and security measures testing under Quebec’s Law 25.
ABOUT THE LAW
WHAT LAW 25 CHANGES
Law 25, adopted in 2021 to modernize Quebec’s privacy laws, including the private-sector privacy Act, has applied in full since September 22, 2024.
Unlike most of its federal and provincial counterparts, it reaches deep into how IT projects and incident response actually run, not just how policies are written.
TWO THRESHOLDS, ONE REGISTRY
In practice, the change is technical, not just legal. Every confidentiality incident goes into a registry you keep for at least five years. Every project to acquire, develop or overhaul an information system involving personal information needs a privacy impact assessment, with your privacy officer consulted from the outset. And responsibility for an incident doesn’t pass to your vendor just because your data sits with them. Law 25 also draws a line between what you log and what you escalate, and the two are easy to confuse.
EVERY CONFIDENTIALITY INCIDENT
Goes into your incident registry — kept for at least five years after the date the organization became aware of the incident — regardless of whether it presented any risk of harm.
SERIOUS-INJURY INCIDENT
If the incident presents a risk of serious injury, you must promptly notify the Commission d’accès à l’information (CAI) and the individuals concerned — not just log it. Getting this classification wrong is expensive: failing to report a serious-injury incident is listed both as grounds for an administrative monetary penalty and as a penal offence.
TWO SANCTION REGIMES
Law 25 sets two separate sanction regimes, and they are often confused. Administrative monetary penalties reach up to $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is higher. Penal fines are a separate track that goes through penal proceedings, and the lists of violations overlap: failing to report a serious incident or to take the security measures section 10 requires can lead to either. Penal fines reach up to $25 million or 4% of worldwide turnover for the preceding fiscal year.
NOT LEGAL ADVICE
This is a description of the statute, not legal advice. We’re a technical and GRC advisory, not a Quebec law firm — for the legal interpretation of a specific incident, that’s a conversation for counsel; we handle the security and process side. We have worked with clients in Canada, and under NDA we cannot name them.
How we work with you
Incident response plan and registry design
A workflow that classifies a confidentiality incident correctly the first time, and a registry built to survive five years of audits.
EFVP for IT projects
Privacy impact assessments for system acquisition, development and redesign projects — methodologically close to the integrated ISO 27001 and ISO 27701 systems our auditors implement for clients.
Security measures assessment
Benchmarked against the CAI’s own examples: strong authentication, encryption of communications, stored data and mobile devices, firewalls and perimeter defence, access logging and monitoring, and timely software updates.
Penetration testing
Verification that the security measures Law 25 requires under section 10 actually hold, not just that they’re documented.
Third-party and vendor risk
Assessing exposure where personal information sits with a processor — the CAI is explicit that your incident obligations stay with you when a third party stores the data.
We build the classification workflow before the next one happens.
What counts as a “confidentiality incident” under Law 25?
Broader than a data breach in the usual sense — the law covers any loss, unauthorized access, use or communication of personal information. Every one of these goes into your registry, even the ones that never leave your building.
Do we have to notify the CAI about every incident?
No. Notification to the Commission d’accès à l’information and to affected individuals is required only when the incident presents a risk of serious injury. Incidents below that threshold still go in your registry — they’re just not reported outward.
Does Law 25 require penetration testing?
Not by name. Section 10 requires security measures that are reasonable given, among other things, the sensitivity of the information, and the CAI’s guidance lists examples such as strong identifiers and passwords, encryption and access logging. Penetration testing is how you demonstrate those measures actually work; it isn’t a line item in the statute.
What is an EFVP, and when do we need one?
Évaluation des facteurs relatifs à la vie privée, a privacy impact assessment. Quebec law requires one for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information, and before personal information is communicated outside Quebec. Your privacy officer must be consulted from the outset. In practice: start it when the project starts, not before go-live.
Our certificates
Team portfolio
Where to start?
You can copy our materials only after making sure that your services are safe.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.