Law 25 Compliance & Privacy Checklist for Businesses

Quebec's Loi 25, commonly known as Law 25 or Bill 64, is one of the most demanding privacy frameworks in North America. The failure to comply can cost you penalties reaching $25 million CAD or 4% of your worldwide turnover.

At DPO Consulting, we have helped organizations across Canada and internationally understand their obligations, close compliance gaps, and build privacy programs that hold up to regulatory scrutiny.

Talk to a Law 25 compliance expert

TRUSTED BY

Determine necessity

Law 25 Compliance Support for Organizations Operating In or Targeting Quebec

Law 25 applies to any organization, public or private, based in Quebec or not, that handles the personal information of Quebec residents. That broad scope means thousands of Canadian and international businesses must meet its requirements, including mandatory appointment of a Privacy Officer, robust consent mechanisms, documented Privacy Impact Assessments (PIAs), and enforceable data subject rights.

DPO Consulting delivers structured, practical law 25 privacy compliance programs built for organizations at every stage of their compliance journey.

Our services

Expert Law 25 Compliance Services for Businesses

It’s important that the individual or organization you assign as your UK representative has extensive experience and familiarity with UK GDPR regulation to avoid any regulatory shortfalls.

Talk to a Law 25 compliance expert

Why Law 25 Compliance Matters for Your Organization

A lack of GDPR compliance opens the door to several potential organizational risks. Our goal is to prevent them.

Talk to a Law 25 compliance expert

Financial Penalties

The CAI can impose penalties of up to $25 million CAD or 4% of worldwide turnover for serious violations. This is active enforcement, not a future risk. Organizations without documented compliance programs are already exposed.

Data Breaches

Law 25 requires prompt notification to the CAI and affected individuals following any incident posing a serious risk of harm. Without a tested response plan, a single breach compounds your legal, financial, and regulatory exposure significantly.

Reputational Damage

Enterprise clients, procurement teams, and consumers are scrutinizing how organizations handle personal data. Non-compliance doesn't just attract fines, it costs contracts and erodes trust that takes years to rebuild. Read Quebec Law 25 Explained to understand the full commercial stakes.

Why choose DPO Consulting?

Why Choose DPO Consulting for Law 25 Compliance

DPO Consulting specializes in the protection of personal data and UK GDPR compliance law. Our services are tailor-made to ensure you’re GDPR compliant no matter where you operate from.

Talk to a Law 25 compliance expert

Businessman in a blue shirt and tie giving a presentation in front of a whiteboard to four seated colleagues.

Proven experience with Quebec privacy law.

Our consultants have deep, hands-on experience with Law 25 and its evolution from Bill 64 through full implementation. We understand both the letter of the law and how the CAI interprets and enforces it in practice.

Tailored compliance programs.

There is no one-size-fits-all approach to law 25 privacy compliance. We design every program around your sector, your size, your existing controls, and your risk profile, giving you a solution that is proportionate, achievable, and defensible.

End-to-end privacy coverage.

From initial assessment through policy development, technical controls, staff training, EFVP delivery, and ongoing monitoring, DPO Consulting covers every dimension of your compliance obligations under one relationship. No coordination gaps. No blind spots.

Long-term compliance partnership.

Privacy law does not stand still. CAI guidance evolves, enforcement priorities shift, and your business changes. Our retained compliance partnerships ensure your program stays current, your team stays informed, and your exposure stays managed, year over year.

Work with professionals

Experts in Law 25 and Global Data Protection Frameworks

DPO Consulting works across GDPR, the UK Data Protection Act, Canada's PIPEDA and provincial equivalents, PDPA frameworks in Southeast Asia, and the EU AI Act, as well as Quebec's Law 25. That global perspective means we bring cross-jurisdictional insight to every engagement, identifying synergies between frameworks and avoiding duplicated compliance efforts.

Organizations already compliant with GDPR will find significant overlap, but Quebec's specific requirements around consent language, EFVP obligations, and CAI notification timelines mean dedicated Law 25 attention is still required.

Commonly asked questions on Law 25 compliance.

Who must comply with Law 25?

Any private-sector organization that collects, uses, communicates, or retains the personal information of Quebec residents must comply, regardless of where the organization is headquartered.

Does Law 25 apply to organizations outside Quebec?

Yes. If your organization targets Quebec residents, through e-commerce, digital marketing, service delivery, or employment, Law 25 applies to how you handle their personal information.

What types of personal information are regulated under Law 25?

Law 25 covers any information that directly or indirectly identifies a natural person, including names, contact details, financial data, health information, biometric data, location data, and online identifiers such as IP addresses and cookies.

How does Law 25 differ from GDPR?

Both frameworks share foundational principles, lawful basis, transparency, data minimization, and individual rights, but Law 25 has Quebec-specific requirements: French-language privacy notices, mandatory EFVP documentation, CAI-specific breach notifications, and strict rules on cross-border data transfers. Organizations that are GDPR-compliant still need dedicated bill 64 law 25 analysis.

What penalties apply for non-compliance?

Administrative penalties reach up to $25 million CAD or 4% of worldwide turnover for the most serious violations. Penal fines for intentional breaches can also reach $25 million. Penalties are tiered by the nature and severity of the violation.

Do GDPR-compliant organizations still need Law 25 support?

Yes. While GDPR compliance provides a strong foundation, Law 25 imposes specific obligations, particularly around Privacy Impact Assessments, consent for cookies, cross-border transfers, and CAI engagement, that are not fully covered by GDPR controls alone. A targeted law 25 compliance checklist review is essential even for organizations with mature European privacy programs.

Check out some of our helpful resources to learn more.

Read all articles

Smiling chef in a white shirt and striped apron standing in a modern kitchen with stovetops and cooking utensils.

GDPR Trends of 2024: What’s Changing & What You Need to Know

Explore the art of storytelling in design and its impact on brand communication.

GDPR Trends of 2024: What’s Changing & What You Need to Know

Separating trends from fads – a deep dive into strategies that truly drive results.

GDPR Trends of 2024: What’s Changing & What You Need to Know

Discover the cutting-edge technologies reshaping the landscape of mobile experiences.

Law 25 Compliance & Privacy Checklist for Businesses

Law 25 Compliance Support for Organizations Operating In or Targeting Quebec

Expert Law 25 Compliance Services for Businesses

Law 25 Compliance Assessments and Gap Analysis

Outsourced Privacy Officer and Governance Support

Consent Management and Privacy Controls

Privacy Impact Assessments and Risk Management

Law 25 Training and Internal Enablement