Law-25 (Quebec) Basics

Quebec’s Law 25 modernized private-sector privacy rules with phased obligations around consent, transparency, cross-border transfers, and individual rights. Many SaaS and mobile teams serving Quebec users need updated privacy notices and operational processes.

Law 25 does not replace GDPR or PIPEDA, but adds Quebec-specific requirements you should reflect in your public privacy policy and internal runbooks.

Priorities for small teams

• Publish a clear privacy policy (French availability is often expected for Quebec-facing products).
• Document what personal information you collect and why; avoid collecting more than you need.
• Establish a process for access, correction, and deletion requests.
• Assign a privacy officer contact and include it in your policy.

Policy URL on forms and apps

Whether you sell in Quebec through a website, mobile app, or lead ads, regulators and partners expect a current privacy policy link. A hosted URL lets you update legal text without breaking integrations.