Quebec’s Law 25 (modernization of private-sector privacy law) imposes stricter rules on organizations that collect personal information about Quebec residents — even if the company is based elsewhere in Canada. Key IT-related themes include appointing a privacy officer, conducting privacy impact assessments for certain projects, tightening consent for sensitive uses, and reporting breaches to the Commission d’accès à l’information. Bilingual privacy notices and data minimization in apps and CRM systems are common compliance tasks. If you serve Quebec customers or employees, align backup retention, access logs, and vendor subprocessors with Law 25 alongside PIPEDA.
