What is Canada Law 25?

Law 25 (earlier Bill 64), officially known as “The Act to modernize legislative provisions as regards the protection of personal information”, is a Canadian provincial law that governs the protection of personal information in Quebec. 

Quebec’s Law 25 modernizes the existing framework of data protection, amending several laws in Quebec. It enhances individual rights and introduces new obligations such as stricter requirements for consent, data breach notification and appointment of a Data Protection Office (DPO).

Law 25 comes into effect through a phased implementation plan in 3 years, starting September 2022, with key provisions coming into force in September 2023.