Quebec Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (2021, c. 25)
Below is what the official text of Quebec Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25 (2021, c. 25) states about whom it covers, when it applies to a business and since when. Where the pages we read do not say, the row says "not stated".
The wording shown is taken from the official page named in each row. The duties of a business and the contents of a privacy notice are in the paid checklist.
Typical situations, run through the same conditions as the check
- A for-profit business established in Quebec: Applies, or may apply: conditions to check.
- A US business with users in Quebec: Applies, or may apply: conditions to check.
- A US business with no users in Quebec: Not triggered by these answers.
Judged on 2026-10-06. Our law data was last verified on 2026-10-06; a law that took effect after that date is not in it. These situations leave other answers blank or neutral: use the check for your own.
What the official text states
| Question | What the official text states | Source |
|---|---|---|
| What it covers | The Act (the 'Loi sur le privé') applies to personal information that an enterprise collects, holds, uses or communicates to third parties, whether kept by the enterprise or by a third party.Official wordingLa Loi s’applique aux renseignements personnels que votre entreprise : Recueille; Détient; Utilise; Communique à des tiers. | www.cai.gouv.qc.ca read 2026-10-06 |
| When it applies to a business | An organization located outside Quebec that collects, holds, uses or communicates personal information in the course of its enterprise's activities in Quebec is subject to the Act. Conditions to check: Source is the regulator's plain-language page, not the statute text (legisquebec.gouv.qc.ca could not be reached when we checked). The test is the organization's enterprise activity in Quebec (organized economic activity, commercial or not; the CAI says non-profits need a case-by-case analysis). A Quebec-based enterprise whose data subjects are elsewhere is not covered by our questions. The CAI page says its text popularizes the law and the legislation prevails. Official wordingUne organisation située à l’extérieur du Québec qui recueille, détient, utilise ou communique des renseignements personnels dans le cadre des activités de son entreprise au Québec est assujettie à la Loi sur le privé. | www.cai.gouv.qc.ca read 2026-10-06 |
| In force from | 2023-09-22 Most Law 25 obligations on enterprises apply from 22 September 2023 (governance policies, consent rules, transparency, privacy impact assessments, default settings). Staged: 22 Sept 2022 (privacy officer, incident rules) and 22 Sept 2024 (data portability). Official wordingà compter du 22 septembre 2023, à titre de personne exploitant une entreprise, vous devrez notamment : | www.cai.gouv.qc.ca read 2026-10-06 |
| Privacy notice | Included in the paid checklist. See the checklist | — |
| Consent and opt-out | Included in the paid checklist. See the checklist | — |
| Rights of individuals | Included in the paid checklist. See the checklist | — |
| Data protection officer | Included in the paid checklist. See the checklist | — |
| Breach notification | Included in the paid checklist. See the checklist | — |
| What the privacy notice must contain | Included in the paid checklist. See the checklist | — |
What we do not cover
These areas are outside this site, so nothing on this page says anything about them:
- Privacy laws for particular sectors (for example health care, banking and credit, education)
- Rules specific to children's online privacy
- Cookie and electronic-communications rules (including consent for cookies and marketing messages)
- Employee, job applicant and contractor data
- Rules on sending personal data to other countries
- US state data-breach notification laws (a separate set of state laws)
- US state privacy laws that are not yet in force, and state laws on particular topics (for example biometric or health data)
- Privacy laws of countries that are not listed here
- Planned changes to the laws listed here