Quebec Law 25: What Newcomers Must Know About Privacy

If you are settling in Montreal, Quebec City, Gatineau, or anywhere in the province of Quebec, you are protected by Quebec's modern personal data protection law: Quebec Law 25 (formerly Bill 64).

Modeled closely after Europe's General Data Protection Regulation (GDPR), Law 25 modernizes Quebec's privacy framework to give residents concrete control over their digital footprint.

Key Rights Granted to You as a Resident

• Explicit, Granular Consent: Companies operating in Quebec cannot bury consent in 50-page terms of service. Consent for marketing or third-party sharing must be requested separately and clearly.
• Right to De-Indexing ("Right to be Forgotten"): You have the right to request that a company or search engine stop disseminating your personal information or de-index a hyperlink attached to your name if the dissemination causes you injury.
• Mandatory Breach Notifications: If an organization holding your personal data suffers a security incident presenting a risk of serious injury, they must notify both you and the Commission d'accès à l'information (CAI).
• Data Portability: You can demand that an organization provide you with your computerized personal data in a structured, commonly used technological format.