Law 25 modernized Quebec’s private-sector privacy regime in staged waves between 2022 and 2024, and it leapfrogged the rest of the country. For any organization operating in Quebec, including security integrators and the vendors whose platforms process Quebeckers’ data, it is the high-water mark to design against, with penalties that changed the conversation: administrative fines up to $10 million or 2% of worldwide turnover, and penal fines reaching $25 million or 4%.
What it adds beyond PIPEDA
The federal baseline will look familiar; Law 25’s additions are the point.
A named privacy officer. By default the CEO, delegable in writing. Someone identifiable is accountable, published, and reachable.
Privacy impact assessments with teeth. A PIA is required for projects involving personal information systems, and specifically before communicating personal information outside Quebec, where the assessment must conclude the information receives adequate protection. Cloud video and hosted access control with out-of-province processing walk directly into this requirement.
Breach reporting. Confidentiality incidents presenting a risk of serious injury must be reported to the CAI and affected individuals, with an incident register kept regardless.
Consent and transparency, tightened. Purposes explained clearly and separately, express consent for sensitive information (biometrics are explicitly sensitive), and technology that identifies, locates, or profiles a person requires being informed and, for profiling, activation choices. Privacy by default is a statutory expectation, not a slogan.
Biometrics, doubly regulated. Quebec separately requires disclosure to the CAI before creating a biometric database. Facial recognition, fingerprint access control, and similar deployments in Quebec carry a regulatory filing, not just a policy update.
What this means for security projects in Quebec
The practical checklist changes. A camera or access deployment for a Quebec client should assume: a PIA exists or is needed, retention is deliberate, signage and notices meet the clearer-disclosure bar, any analytics that profile or identify get flagged to the client’s privacy officer, biometric plans trigger the CAI disclosure conversation, and any platform storing data outside Quebec needs the cross-border assessment done before signature, not after. Vendors selling into Quebec get asked for the documentation that makes those client obligations satisfiable; the ones who cannot produce it lose Quebec deals quietly.
What trips people up
Assuming headquarters location matters: the law follows the person in Quebec whose information is collected. Treating biometrics casually: the separate database-disclosure duty is missed constantly, including by national deployments that switched on fingerprint readers province-wide. And under-rating the enforcement change: pre-2022 Quebec privacy enforcement was polite; the current penalty ceilings were designed to end that era, and boards have noticed.
How it fits
Design national systems to Law 25 and PIPEDA compliance follows almost automatically; the reverse is not true. Our data residency guide covers the cloud-video angle in depth.
Related guides
References
Last updated 2026-07-24.