Québec · Legislation
Québec Law 25 (Bill 64) has been enacted.
Fully in effect since September 2024, Law 25 imposes GDPR-style obligations on all organizations processing personal data of Québec residents, including mandatory Privacy Impact Assessments for AI systems, explicit disclosure when decisions are made exclusively through automated processing (Section 12.1), and penalties up to $25 million CAD or 4% of worldwide turnover. The Commission d'accès à l'information (CAI) is ramping up enforcement audits in 2026, making it Canada's strictest provincial AI privacy framework.
Act to modernize legislative provisions as regards the protection of personal information (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels)
Read the bill text and legislative history at the source.
Put this record in front of EcoGPT and ask follow-up questions.
What would Québec Law 25 (Bill 64) require of companies that handle personal data?