Quebec's Law 25: What Ontario & GTA Businesses Serving Quebec Customers Need to Know

Many businesses in Toronto and the GTA sell to, market to, or serve customers in Quebec — and a surprising number do not realize that Quebec's private-sector privacy law, commonly known as Law 25, can apply to them even though they have no office in the province. Law 25 is one of the strictest privacy regimes in North America, and its obligations follow the personal information of Quebec residents, not the address of the business that holds it.

This guide explains, in plain terms, what Law 25 asks of a business and where your IT environment fits. It is general information, not legal advice — for how the law applies to your specific situation, speak with a privacy lawyer. What we can help with is the technical side: the security controls, data handling, and documentation that a compliance program is built on.

What Law 25 Is

Law 25 (adopted in Quebec in 2021, with obligations phased in between 2022 and 2024) modernized Quebec's private-sector privacy rules. It applies to organizations that collect, hold, or use the personal information of people in Quebec — which can include an Ontario business with Quebec customers, an e-commerce store shipping to Montreal, or a service provider whose client base crosses the provincial border.

The Core Obligations

A Person Responsible for Personal Information

Every organization subject to the law must designate someone responsible for the protection of personal information and publish that person's title and contact information. By default this is the highest-ranking officer.

Confidentiality Incident Reporting

When a confidentiality incident — a breach, loss, or unauthorized access — presents a risk of serious injury, the organization must notify Quebec's privacy regulator (the Commission d'accès à l'information) and the affected individuals, and must keep a register of all incidents. That means you need to be able to detect incidents in the first place, which is where monitoring and managed detection and response earn their keep.

Privacy Impact Assessments

Law 25 requires privacy impact assessments in defined situations, including when personal information is communicated outside Quebec. If your systems, backups, or cloud services store Quebec customers' data in other provinces or countries, that transfer is something your compliance program has to account for.

Consent, Transparency, and Individual Rights

The law tightens consent requirements, requires clear privacy policies, and gives individuals rights over their information — including deletion (de-indexing) and, since 2024, data portability. Practically, your business needs to know what personal data it holds, where it lives, and how to retrieve or delete it on request. That is a data-inventory and systems question as much as a legal one.

Real Penalties

Law 25 carries administrative monetary penalties and, for serious offences, fines that can reach the greater of $25 million or 4% of worldwide turnover. Enforcement is real, and 'we didn't know the law applied to us' is not a defence.

Where Your IT Environment Fits

A privacy program is policy plus technology. The technical controls that support Law 25 readiness are largely the same ones that support PIPEDA and good security generally: knowing where personal data is stored (data mapping), encryption at rest and in transit, access controls and multi-factor authentication so only authorized people touch personal information, monitoring and managed detection and response so a confidentiality incident is detected and documented quickly, tested backups with a known storage location, and retention and deletion processes that can actually honour an individual's request.

The Bilingual Service Angle

If you serve Quebec customers, being able to respond to privacy requests and support issues in French is a practical requirement of doing business there, beyond what any statute says. When choosing vendors and support partners, it is worth asking how French-language requests will be handled end to end.

A Sensible Path for a GTA Business

1. Confirm with counsel whether Law 25 applies to your operations. 2. Inventory the personal information you hold and where it is stored, including cloud services and backups. 3. Close the technical gaps: encryption, MFA, access controls, detection, tested backups. 4. Document incidents and be ready to report. 5. Review the same controls against PIPEDA, since both regimes will usually apply to an Ontario business.

How IT Rapid Support Helps

IT Rapid Support provides the technical foundation that privacy compliance programs are built on for businesses across Toronto and the GTA: data protection, access management, encrypted and tested backups, and 24/7 managed detection and response that helps you detect and document incidents. We work alongside your legal and privacy advisors — they define the obligations, we implement the controls. Call (289) 582-9930 to review where your systems stand.