Law 25, introduced as Bill 64, rewrote Quebec’s private-sector privacy statute and came into force in three phases between September 2022 and September 2024. It is close to the GDPR in shape, and the Commission d’accès à l’information enforces it with penalties to match.
QUEBEC LAW 25 · CAI · FULLY IN FORCE
Scoped for Law 25 back in 2022? You are two phases behind.
Law 25 came into force in three phases, and all three had landed by September 2024 - a 2022 scope has no runway left.
Bill 64
Privacy officer
PIAs
72-hour clock
Article 12.1
Our promise
“A notice is a page. The assessment is evidence.”
Every finding is written against a clause of the instrument itself — defensible line by line, to anyone who asks. The fee is fixed at $12,500, and nothing is charged until you approve it.
- Each additional system
- $3,000
- Re-audit, same scope
- $8,000
- Renewal, every twelve months
- $10,500 locked
This costs more than the estate ladder, and it should. The ladder is a private assessment written for you. A framework audit produces a published summary iDharma maintains for twelve months - a notice template where the law requires one, a 60-day expiry warning, and a quarterly check that the summary is still live and still linked.
Request this auditThe case file
Law 25, in three chapters
Most programmes were scoped in 2022, when only the governance duties were live. Everything with real operational weight arrived a year later - impact assessments, the seventy-two-hour incident path, express consent - and a 2022 scope was written before any of it existed.
We score every finding against the phase it arrived in, so an older programme shows its own gap rather than being told it has one. Then the seventy-two-hour path gets walked against your own escalation route, and Article 12.1 is answered as the process question it really is.
Who is caught
Whose information, not where you sit.
Personal information of Quebec residents, held in the course of commercial activity - wherever you are established.
- Organisations operating in Quebec
- Anyone holding Quebec residents’ information
- Suppliers processing on a Quebec entity’s behalf
- Anyone running decisions made by machine
- Before the processing - the assessment comes first
- At collection, purpose by purpose, for consent
- Within 72 hours of becoming aware of an incident
- Before information leaves the province
Whose duty is it
The duty is yours. So is the machine’s.
Whoever holds the information
Any organisation collecting, holding, using or disclosing the personal information of Quebec residents in the course of commercial activity. Every duty on this page lands on you - the privacy officer, the assessments, the notices, the incident path - wherever in the world you are established.
The people who process for you
A service provider handling personal information on behalf of a Quebec entity. The duty follows the data to them, and a transfer of that information outside the province needs an assessment that the receiving jurisdiction protects it equivalently, made before the information moves, not after.
A machine decision owes a person
Under Article 12.1, where a decision is based exclusively on automated processing the individual must be told and must be able to make representations to someone who can change the outcome. A reviewer who can only confirm the output, or only explain it afterwards, does not satisfy that requirement.
What most teams assume
“We did Law 25 back in 2022.”
What the statute says
Two more phases have landed since.
It is the first thing we have to correct.
- Who it is for
- Retail & e-commerce
- Banks & insurers
- Health & education
- SaaS serving Quebec
- Credit & scoring teams
Why this matters
02
Two penalty routes, administrative and penal, and both of them are linked to worldwide turnover. This page prints neither of the figures.
03
The ceiling is not the point. The Commission can audit on its own initiative and order a practice stopped, which is faster than a fine.
04
Law 25 sits alongside the GDPR and the CCPA rather than replacing either of them. Most of the work is mapping across, not rebuilding.
The 60-second check
Three questions. Then you’ll know.
No email. No signup. A starting point, not a determination.
Opens in a panel. Close it any time - your answers are kept.
Quebec Law 25 · CAI
Your scope check
The calendar
Three phases, and all of them have landed.
The dates matter now only as a way of finding which duties an older programme was written before.
-
Governance
22 Sept 2022The privacy officer, the incident register and the transparency duties. Programmes that started here often stopped here too.
-
The real weight
22 Sept 2023Impact assessments, the 72-hour incident path, express consent and transfers out of the province. This is the phase that bites.
-
Fully in force
22 Sept 2024Data portability arrived and everything else applied in full. There has been no remaining runway to plan against since.
-
Keep it current
ContinuouslyAn impact assessment describes the processing it was written for. When that changes, the assessment has to change with it.
The trap
A programme scoped in 2022 was built when only phase one was live. It will have a privacy officer and a notice set and no impact assessments - and the seventy-two-hour path will exist on paper without anyone having walked it.
Requirement & coverage
What the law says, what we ship
12 duties, each carrying the phase it arrived in.
- Designated privacy officer Phase one, 2022
- The appointment written down and the contact published where somebody outside the organisation can find it, rather than named in an internal policy nobody has read.
- Confidentiality incident register Phase one, 2022
- A register of incidents whether or not they were notifiable, with the assessment recorded either way - because a decision not to notify is the one you have to defend later.
- Transparency and notices Phase one, 2022
- Notices in clear and simple language at the point of collection, naming the purposes and the means rather than describing them in general terms.
- Privacy impact assessments Phase two, 2023
- A screening test that says when an assessment is required, the methodology behind it, and completed assessments for the processing that actually triggers it.
- Incident notification Phase two, 72 hours
- A detection-to-decision path reaching the Commission and the individuals inside seventy-two hours, with the risk-of-serious-injury test applied in advance.
- Express, specific consent Phase two, 2023
- Consent sought purpose by purpose rather than bundled, in terms separate from the rest of the notice, with the position on minors recorded.
- Transfers out of Quebec Phase two, 2023
- An assessment that the receiving jurisdiction offers equivalent protection, per route, with the reasoning kept rather than the conclusion asserted.
- Privacy by design and default Phase two, 2023
- A privacy gate in the delivery lifecycle, and settings that default to the highest level of confidentiality without the individual having to ask.
- Data portability Phase three, 2024
- A structured, commonly used technological format for the information the individual provided, with a defined export route per system rather than a manual extract.
- Access, correction, de-indexing Across the phases
- One intake route somebody outside can find, identity verification, and a search that reaches the backups and the ticketing system rather than the primary database alone.
- Automated decisions Article 12.1
- A register of decisions made exclusively by automated processing, the disclosure at the time the decision is made, and a person who can actually change the outcome.
- Accountability Across the phases
- Governance policies approved and published, training records, and the evidence pack that demonstrates the programme rather than asserting that one exists.
The engagement
Personal information, independently reviewed
From the CRM to the model in the decision path.
-
Intake
Which systems hold Quebec personal information, and what each is for.
-
Test
Every duty across the three phases against the estate as it runs.
-
Sign off and evidence
You see the draft first. Then the assessments, notices and drills - dated.
Struck in your favour
Why teams choose iDharma for their Law 25 review
Scored by phase
Every finding carries the phase it arrived in, so an older programme shows its gaps plainly.
Article 12.1, answered
The automated-decision duty tested as a process running end to end, which is what it actually is.
The clock, rehearsed
The 72-hour path walked end to end against your own escalation route, not a generic template.
GDPR work carries over
Law 25 is close to the GDPR in shape, so existing work maps across rather than restarting.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
Law 25 review report
The full review: what you hold, on what consent, under which duty - and where each one is evidenced or is not, written phase by phase so an older programme shows its own gap. Findings are ranked by consequence to people rather than by ease of fixing, with the automated-decision and transfer positions stated separately.
Privacy impact assessments
The screening test that says when one is required, the methodology behind it, and completed assessments for the processing that actually triggers it.
Processing inventory
What you hold, why, who it goes to and where it leaves the province - built from the systems inwards rather than from a questionnaire sent round.
Incident path and drill
Detection to notification against the seventy-two-hour clock, with the risk-of-serious-injury test written down first and the path walked once.
Consent and notice set
Consent sought purpose by purpose in terms separate from the rest, and notices in clear language at the point the information is collected.
Automated decision register
Where a decision is made exclusively by machine: the disclosure, the human route named, and what that person is actually able to change.
Policy template pack
The governance set, the risk and assessment set and the incident and response set - written to Law 25 rather than handed over as a generic pack.
Format & fee
Real numbers, upfront.
- Scope
- Set by the statute
- Inputs
- Your systems and your records
- Re-review
- Every twelve months - $10,500 against your known baseline
The statute fixed the duties, so the fee is flat - nothing to meter, and nothing charged until you approve it.
Request this review
Law 25 · Named engagement
$12,500 flat
- Findings scored by phase
- Impact assessment method
- The 72-hour path, walked once
- 26 policy templates, tailored
Show your hand
Four things you have to be able to produce
Law 25 is not graded on intent. Each of these is either in your hand on the day someone asks, or it is not.
The officer,
published
A designated privacy officer whose contact somebody outside can find without asking you for it. It is the first duty the statute imposed and the easiest to be caught short on.
Assessments,
current
An impact assessment for the processing that triggers one, updated when the circumstances changed rather than filed away on the day that it was written.
The clock,
walked
Seventy-two hours to the Commission and to the individuals, with the risk-of-serious-injury test decided in advance because deciding it live is how it is missed.
The human,
reachable
For any decision made exclusively by machine: a person the individual can make representations to, who has the authority to change the outcome rather than confirm it.
Four cards, and the date on each one is part of the card.
FAQ
Plain answers
What the law is, whether it reaches you, the clock, and where AI lands. Answered straight.
Request this reviewWhat is Quebec Law 25?
Introduced as Bill 64, it is the Act to modernize legislative provisions as regards the protection of personal information. It substantially rewrote Quebec’s private-sector privacy statute and came into force in three phases between 22 September 2022 and 22 September 2024.
Who needs to comply with Law 25?
Any organisation that collects, holds, uses or discloses the personal information of Quebec residents in the course of commercial activity - wherever it is established. The test is whose information you hold, not where your office is.
What triggers the 72-hour incident notification?
A confidentiality incident presenting a risk of serious injury. The Commission and the affected individuals are both notified, and the seventy-two hours run from becoming aware - so the risk assessment is the step that eats the clock.
How does Law 25 apply to automated decision-making and AI?
Under Article 12.1, where a decision is based exclusively on automated processing the individual must be informed of that at the time, and must be able to make representations to a person able to change the outcome. A reviewer who can only confirm the output does not satisfy it.
What does an iDharma Law 25 review cost, and what do we get?
A flat fee for the named engagement, agreed before anything is charged. What lands is the review report, the impact assessment method, the processing inventory, the incident path and drill, the consent and notice set, the automated decision register and the policy template pack.
Get started
Request your Law 25 review
Tell us where the Quebec information lives and we come back in a day.
What we need from you
Nothing you do not already have. Most of this comes out of a morning with your legal, engineering and data teams, and we tell you which extracts before you commit.
- Which systems hold Quebec personal information
- When your Law 25 programme was last scoped
- Your privacy officer designation, and where it is published
- Where a decision is made only by machine
- Where information leaves the province, and on what basis
What happens next
- You send the five items we need.
- We call to scope it within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
Where this page gets its facts
Where the claims on this page come from, and what they are worth - stated, not assumed.
What it is drawn from
- The private-sector Act as amended by Law 25
- The Commission d’accès à l’information, on its guidance
- First phase
- 22 September 2022
- Fully in force
- 22 September 2024
What it means
- General information about what the statute requires — not legal advice, and no professional relationship.
- Where a scope question is genuinely arguable, our reports say so rather than pick the convenient answer.
Scope & limitation
- No penalty figure appears here. Our own source and the reference this page was written against state the administrative and penal ceilings the other way round from each other — so for a number, go to the Commission.
- Do not rest a binding decision on it; engage qualified counsel, and use it as the start of a scoping conversation rather than as your final word.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
INSIGHTS
Startups, Meet Your AI Stack: Budget‑Friendly Tools That Scale
For early-stage founders, building an AI-powered toolkit doesn’t have to break the bank. From ideation to growth mode, here’s how startups can tap into affordable, effective AI tools to autom
