Quebec Law 25: A Practical Compliance Guide for Professional Firms

Quebec's Law 25 has reshaped privacy obligations for every organization that handles personal information in the course of doing business in Quebec. Its requirements came into force in three phases between September 2022 and September 2024, and they are now fully in effect. For law firms, accounting practices, financial advisors and other professionals who hold sensitive client files, Law 25 sets the highest privacy bar in Canada.

This guide walks through what the law requires and what a professional firm should have in place today.

What Is Law 25?

Law 25 (formerly Bill 64) modernized Quebec's Act respecting the protection of personal information in the private sector. It applies to organizations that collect, hold, use or communicate personal information while carrying on an enterprise in Quebec. Firms based in other provinces that serve Quebec clients may also be affected, so it is worth confirming your position with legal counsel.

The Three Phases

• September 2022: designation of a person in charge of protecting personal information, mandatory reporting of confidentiality incidents, and an incident register.
• September 2023: the bulk of the obligations, including governance policies, privacy impact assessments, stricter consent rules, privacy by default, rules for communicating information outside Quebec, and transparency about automated decisions.
• September 2024: the right to data portability, allowing individuals to request their computerized personal information in a structured, commonly used technological format.

Key Obligations for Professional Firms

1. A Person in Charge of Privacy

By default, the person with the highest authority in the organization is responsible for protecting personal information. That responsibility can be delegated in writing to someone else. The title and contact information of this person must be published on your website.

2. Confidentiality Incident Reporting

When a confidentiality incident presents a risk of serious injury, you must promptly notify the Commission d'accès à l'information (CAI) and the affected individuals. Every incident, serious or not, must be recorded in an incident register, and the CAI can request a copy at any time.

3. Privacy Impact Assessments

A privacy impact assessment (PIA) is required for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information. A PIA is also required before communicating personal information outside Quebec.

That second point matters more than many firms realize: data hosted in another Canadian province is technically "outside Quebec." The assessment must consider whether the information will receive adequate protection, and the arrangement should be backed by a written agreement. Choosing a provider that stores data exclusively in Canada, under Canadian law, makes this assessment far simpler than relying on servers in foreign jurisdictions.

4. Governance Policies

Firms must adopt and publish policies describing how personal information is governed: roles and responsibilities, retention and destruction, and how complaints are handled.

5. Consent and Privacy by Default

Consent must be clear, free, informed and given for specific purposes. Requests for consent must be presented separately from other information. Technology products and services offered to the public must use the highest level of confidentiality by default, without any action required from the individual.

6. Retention and Destruction

Once the purpose for collecting information has been achieved, it must be destroyed or anonymized, subject to any legal retention periods that apply to your profession.

Penalties

Law 25 introduced significant enforcement powers. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater. Individuals also have a private right of action, including punitive damages of at least $1,000 where an infringement is intentional or results from gross fault.

A Practical Checklist

• Designate your privacy officer and publish their title and contact information on your website
• Create and maintain a confidentiality incident register
• Document an incident response procedure, including how you assess "risk of serious injury"
• Complete PIAs for new systems and for any storage or processing outside Quebec
• Publish your governance policies in clear, simple terms
• Review consent forms so each purpose is separate and specific
• Set retention schedules and a secure destruction process
• Make sure you can export a client's personal information in a usable format on request

How Your Technology Choices Help

Much of Law 25 compliance comes down to knowing where client information lives, who can access it, and being able to prove it. A document platform with Canadian-only data storage, detailed audit trails, role-based access controls and configurable retention gives you the evidence you need when a client, regulator or auditor asks.

SecureVault stores all client data exclusively in Canada and includes audit logging, retention controls and secure sharing built for regulated professionals. See plans or start a 14-day free trial.

This article is for general information only and is not legal advice. Consult qualified counsel about your firm's specific obligations under Law 25.