Does Quebec's Law 25 apply to my startup if we're not in Quebec?

“Law 25” is the 2021 statute that rewrote Quebec’s private sector privacy act. Its changes came into force in stages, and the act it amended, the Act respecting the protection of personal information in the private sector, is what you comply with. For an Ontario startup with Quebec users, it sits alongside PIPEDA rather than replacing it.

Does it apply to a business outside Quebec?

Section 1 says the Act applies to personal information about other people that a person collects, holds, uses or communicates in the course of carrying on an enterprise. It doesn’t say the enterprise must be located in Quebec, it has no size or revenue threshold, and it doesn’t spell out how far it reaches businesses with no presence in the province. So if you market to Quebec, sell to Quebec customers or have a meaningful number of Quebec users, the safer course is to build its requirements into your product and documents.

PIPEDA still applies too. The Privacy Commissioner of Canada says PIPEDA covers personal information that crosses provincial or national borders in the course of commercial activities, including in provinces with their own laws.

How is it different from PIPEDA?

Topic	PIPEDA	Quebec private sector act
Privacy policy	Make information about your practices readily available (Principle 4.8)	Publish a confidentiality policy on your website in clear and simple language, and give notice of changes (s. 8.2)
Person responsible	Designate someone accountable; identity available on request	The person with the highest authority, by default; can delegate in writing; title and contact details published on your website (s. 3.1)
Governance	Policies and practices to give effect to the principles	Governance policies covering retention, destruction, roles and complaints, with detailed information published on your website (s. 3.2)
Consent	Meaningful consent; express for sensitive information	Clear, free and informed, for specific purposes, requested separately for each purpose (s. 14)
Tracking and profiling	Covered by general consent rules	Tell people first, and tell them how to activate functions that identify, locate or profile them (s. 8.1)
Privacy by default	No express rule	Products offered to the public with privacy settings default to the highest level of confidentiality, except browser cookie settings (s. 9.1)
Data leaving the jurisdiction	You stay accountable; use contracts	Privacy impact assessment and a written agreement before communicating personal information outside Quebec (s. 17)
Automated decisions	No express rule	Tell people when a decision about them is based exclusively on automated processing (s. 12.1)
Breaches	Report if there’s a real risk of significant harm (s. 10.1)	Notify the Commission and affected people if an incident presents a risk of serious injury, and keep a register of all incidents (ss. 3.5 and 3.8)
Children	OPC: parental consent for under 13 in all but exceptional cases	Parental consent to collect from a minor under 14, unless clearly for the minor’s benefit (s. 4.1)
Penalties	Fines up to $100,000 for listed offences	Administrative penalties up to $10 million or 2% of worldwide turnover; fines up to $25 million or 4% (ss. 90.12 and 91)

What changes in my privacy policy?

Your policy should be published on your website, written in clear and simple language, and cover what s. 8 requires you to tell people at collection: the purposes, the means of collection, the rights of access and correction, the right to withdraw consent, who receives the information, and the possibility that it could be communicated outside Quebec. Add the title and contact information of the person in charge of protecting personal information. If you use tracking, location or profiling features, explain them and how to turn them on. See what a Canadian privacy policy must include.

Who is the person in charge at a startup?

By default, the CEO or whoever holds the highest authority. Section 3.1 lets that person delegate the role, in whole or in part, in writing. The Commission d’accès à l’information notes that the person with the highest authority stays accountable even after delegating. See does my company need a privacy officer.

Does hosting on AWS or another US cloud count as sending data outside Quebec?

Yes. Section 17 applies when you communicate personal information outside Quebec and when you entrust someone outside Quebec with collecting, using, communicating or keeping it for you. That covers cloud hosting and most sub-processors, including ones in Ontario. You need a documented assessment and a written agreement that reflects it. See can I store Canadian data in the US.

Do my terms and privacy policy need to be in French?

Possibly. That rule comes from a different statute. Section 55 of the Charter of the French language requires contracts of adhesion, such as standard terms of service, to be given in French before a party can agree to be bound by another language version, though the rule doesn’t apply to contracts used in relations with persons outside Quebec. If you actively sell to Quebec customers, get advice on French versions of your terms and policy.

Where do startups usually start?

1. Decide who is the person in charge, document any delegation, and publish the contact details.
2. Map your data, including every vendor outside Quebec, and document the s. 17 assessments.
3. Turn off non-essential tracking and profiling by default for Quebec users. See cookie banners in Canada.
4. Update your privacy policy and data processing agreements.
5. Set up an incident register and response plan. See when to report a privacy breach.
6. Make sure you can export a user’s data in a structured, commonly used format on request (s. 27). See privacy access requests.

For a longer look at the product changes, see Quebec’s Law 25 for SaaS.

What to do next

We prepare privacy policies that cover Quebec users as well as PIPEDA. Quebec users can change the scope, and any change to the fee is quoted before work starts. Fees are on our fees page.

This guide is general information about Ontario and Canadian law, not legal advice for your situation. If you have Quebec users and want to check where you stand, book a free 15-minute consult.