Quebec Law 25 (privacy)

Quebec Law 25 modernized Quebec's private-sector privacy law, adding duties for businesses that hold personal information about staff and candidates.

Also called: Law 25, Bill 64, Loi 25, Quebec privacy law

What quebec Law 25 (privacy) means

Law 25 is the Quebec law that modernized the province's rules on protecting personal information. It amended Quebec's private-sector privacy act and brought in new duties for businesses, including small ones, that collect, use or keep personal information about people in Quebec.

For an employer, that personal information includes job applicants' résumés, interview notes and reference checks, and employees' files, pay records, medical notes and any monitoring data. Law 25 affects how you collect it, how you explain what you do with it, how you protect it, and what you do if something goes wrong.

The Commission d'accès à l'information du Québec oversees the law. If you employ people in Quebec, or collect personal information there, read the Commission's guidance for businesses.

How it works

Know who is responsible. By default, the person with the highest authority in your business is responsible for protecting personal information. They can delegate all or part of the role in writing. Publish that person's title and contact details on your website, and make sure staff and candidates know how to contact them.

Write down your practices. Keep a short, plain policy on what personal information you collect about candidates and employees, why, who can see it, how long you keep it and how you destroy it. Tell people about it when you collect their information, for example in your job postings or application form and in your onboarding package.

Collect only what you need and get consent where it is required. Be especially careful with sensitive information, such as health information, and with sharing information outside your business, such as with a payroll provider or a cloud service. Before you send personal information outside Quebec, for example to a cloud service hosted elsewhere, you must carry out a privacy impact assessment. One is also needed when you acquire, build or overhaul an information system or electronic service that involves personal information.

Plan for privacy incidents. If personal information is lost, stolen or accessed without permission, act quickly to limit the harm, assess the risk to the people affected, and record it. Every business must keep a register of all confidentiality incidents, including minor ones, and keep each entry for at least 5 years. If an incident presents a risk of serious injury, you must also notify the Commission d'accès à l'information and the people affected.

Respect people's rights over their information. Candidates and employees can ask to see and correct the information you hold about them. Have a simple process to answer those requests.

Remember language rules. Quebec job offers must be written in French, and your privacy communications with Quebec staff and candidates should be easy for them to understand.

Is it the same in every province?

Law 25 is a Quebec law. Its new duties came into force in stages between 2022 and 2024, so all of them now apply. If you employ people in Quebec or collect personal information there, check how it applies to you. Employers elsewhere follow PIPEDA or their own province's privacy law, depending on their sector and province.

Example: Getting ready at a Sherbrooke furniture maker

Isabelle runs a 22-person furniture workshop in Sherbrooke. She realizes she has never written down how she handles employee and candidate information, and that résumés, medical notes and pay records are mixed together in one shared drive.

She names herself as the person responsible for personal information and puts her contact details on the company website and in the onboarding package. She moves medical notes into a separate restricted folder, sets a retention period for unsuccessful applicants, writes a one-page privacy policy in French, and starts a simple log for any privacy incident.

Employee records in the Staffkin HR Suite

Staffkin HR Suite employee records keep profiles, documents and job history in one place, which helps you see what personal information you hold about each employee.

Book a demo

Free tools and guides for this

Questions about quebec Law 25 (privacy)

Does Quebec Law 25 apply to small businesses?

Yes. Law 25 applies to businesses that collect or hold personal information in Quebec, whatever their size. Check the Commission d'accès à l'information's guidance for businesses.

Does Law 25 cover employee information?

Yes. Personal information about employees and job applicants, such as résumés, pay records and medical notes, is covered.

Does Law 25 apply to employers outside Quebec?

It can, if you collect or hold personal information about people in Quebec. Employers with no Quebec staff or candidates follow PIPEDA or their province's own privacy law.

Official sources

General information for Canadian employers, not legal advice. Rules differ by province and territory and change over time, so check with your provincial employment standards office (or the federal Labour Program if you are federally regulated) before you rely on it. See employment standards by province.

Checked against official sources on 5 November 2026.