Quebec's Law 25 for SaaS and app startups with Quebec users
Written by For Founders Law, a Toronto firm licensed by the Law Society of Ontario. About us
In short
Quebec's private sector privacy law, as amended by Law 25, is stricter than PIPEDA in several ways that matter to software companies: a named person in charge of privacy, privacy impact assessments before sending personal information outside Quebec, tracking and profiling features turned off by default, notice of automated decisions and a right to data portability. Startups based elsewhere with Quebec users should assume the law reaches them and build these points into their product and contracts.
Most Canadian startups outside Quebec build their privacy program around PIPEDA. If your product has users in Quebec, that isn’t enough. Quebec’s private sector privacy statute, amended by the law commonly called Law 25, came fully into force in stages between September 2022 and September 2024.
This post is general information, not legal advice.
Does it apply to you?
Quebec’s Act applies to personal information collected, held, used or communicated by a person carrying on an enterprise. How far it reaches businesses located outside the province isn’t fully settled, so a startup that markets to Quebec residents or has a meaningful number of Quebec users should plan on complying.
What Law 25 requires
A person in charge of privacy. The person with the highest authority in the enterprise, usually the CEO, is in charge of the protection of personal information by default, and can delegate the role in writing. Their title and contact information must be published on your website.
Published governance policies. You must adopt and publish, in clear and simple terms, information about your policies and practices for governing personal information, including retention and destruction, roles and complaint handling.
Privacy impact assessments. Under section 3.3, a privacy impact assessment is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information. Under section 17, before communicating personal information outside Quebec, you must also assess whether the information would receive adequate protection, taking into account its sensitivity, the purpose, the safeguards and the legal regime where it’s going. That includes sending it to cloud hosting or sub-processors in Ontario, the US or elsewhere. The arrangement must be governed by a written agreement.
Consent. Consent must be manifest, free and enlightened, given for specific purposes, and requested separately for each purpose in clear and simple terms. Sensitive information generally needs express consent.
Privacy by default. Under section 9.1, technological products and services offered to the public that have privacy settings must offer the highest level of confidentiality by default, without any intervention by the person. That section expressly doesn’t apply to browser cookie settings, but cookies and analytics that identify, locate or profile people are still caught by the tracking rule below, so default-on analytics need a second look.
Tracking, location and profiling. Under section 8.1, if you use technology that can identify, locate or profile a person, you must tell them about it and how to turn it off. Those functions must be off by default.
Automated decisions. Under section 12.1, if you use personal information to make a decision based exclusively on automated processing, you must tell the person, and on request tell them the personal information used, the reasons and principal factors behind the decision, and their right to have it corrected. They must be able to submit observations to someone who can review the decision. AI startups making eligibility, pricing or risk decisions about individuals should design for this now.
Confidentiality incidents. If an incident presents a risk of serious injury, you must notify the Commission d’accès à l’information and the affected people promptly, and keep a register of all incidents.
Data portability. Since September 2024, on request, computerized personal information collected from a person must be communicated to them, or to someone they name, in a structured, commonly used technological format.
Penalties
The Commission can impose administrative monetary penalties (section 90.12) of up to $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines (section 91) can reach $25 million or 4% of worldwide turnover. Individuals can also sue, and the Act allows punitive damages of at least $1,000 for an intentional infringement or gross fault.
French language
Separately from privacy law, Quebec’s Charter of the French Language affects consumer-facing contracts and documents. If you offer terms of service to Quebec consumers, get advice on French versions of your terms and privacy policy.
Where startups usually start
- Name your person in charge of privacy and publish their contact details.
- Map where personal information goes, including every vendor outside Quebec, and document an assessment for those transfers.
- Turn off non-essential tracking and profiling by default for Quebec users.
- Add an automated decision notice if your product makes decisions about individuals without human review.
- Add a confidentiality incident register and response plan.
- Update your privacy policy and your data processing agreement with business customers to cover Quebec requirements.
- Build an export function for data portability requests.
Business customers in Quebec will increasingly ask about these points in procurement. Having answers ready shortens the sales cycle. See privacy policies for apps and SaaS agreements.
We prepare privacy policies and SaaS agreements at fixed fees, listed on our fees page. If you have Quebec users and want to check where you stand, book a free 15-minute consult.