A Vancouver-based e-commerce SMB gets an email in September 2025 from the Commission d’accès à l’information du Québec (CAI). The company has never had an office in Quebec, never had an employee in Quebec, and has never intentionally marketed to Quebec residents. But their online store accepts orders from anyone in Canada including, as it turns out, several hundred customers from Quebec over the past three years. The CAI is asking about their privacy officer designation, their consent management practices, their breach notification procedures, and their retention policies. Under Quebec Law 25, all of these are now their legal obligation.
This scenario is not hypothetical. Quebec Law 25 formally ‘An Act to modernize legislative provisions as regards the protection of personal information,’ originally introduced as Bill 64 has extraterritorial reach that many Canadian businesses have not fully absorbed. It applies to any organization holding personal information about Quebec residents, regardless of where the organization itself is located. A Calgary manufacturer with Quebec customers, a Toronto SaaS company with Quebec subscribers, a Vancouver clinic with Quebec patients, and a Halifax retailer with Quebec online orders are all subject to Law 25.
The Office of the Privacy Commissioner of Canada has publicly acknowledged that Quebec Law 25 imposes obligations that exceed PIPEDA in several material respects. The Canadian Bar Association’s national privacy section has issued guidance noting that Law 25 is the strictest private-sector privacy law in Canada and, in some respects, in North America.
Law 25 has been rolled out in phases since September 2022, with the final major provisions taking effect in September 2024 data portability, right to demand deidentification, and the full breadth of automated decision-making transparency obligations. As of 2026, the Commission d’accès à l’information du Québec (CAI) is actively enforcing Law 25 with published decisions, monetary administrative penalties, and public naming of non-compliant organizations.
GAM Tech has supported Canadian businesses through Law 25 compliance from our 8 offices across Alberta (Calgary HQ, Edmonton, Red Deer), British Columbia (Vancouver, Victoria), Ontario (Toronto, Ottawa), and Quebec (Montréal) with bilingual English and French support in Ottawa and Montréal, and a Montréal office located at 2485 Rue Fleury E that gives us direct expertise in Quebec regulatory expectations. What follows is a practical guide for Canadian businesses outside Quebec whose operations, customer base, or supply chain now brings them under Law 25.