Home › Compare laws side by side › Quebec Law 25 vs EU GDPR

Quebec Law 25 vs EU GDPR

Act respecting the protection of personal information in the private sector (CQLR c P-39.1), as amended by Law 25 (Bill 64) (Quebec, Canada) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	Quebec Law 25 Quebec, Canada 10/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force; amendments phased in Sep 2022, Sep 2023 (main wave) and Sep 2024 (data portability).✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Enterprises that collect, hold, use or communicate personal info in the course of carrying on business in Quebec.	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	No size or revenue thresholds; applies to any enterprise handling personal info.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Commission d'accès à l'information du Québec (CAI)✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Notify the CAI and affected persons promptly of any confidentiality incident that presents a risk of serious injury; keep an incident register and give it to the CAI on request. The Act sets no fixed number of days.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Respond to access or rectification requests within 30 days of receipt; no answer in time counts as a refusal. Data portability in a structured, commonly used format available since 22 Sep 2024.✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	The person with the highest authority (e.g., CEO) is by default the person in charge of protecting personal information; may delegate in writing. Title and contact details must be published on the website.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	Being verified	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Before communicating personal info outside Quebec (including to other provinces), complete a privacy impact assessment; transfer only if it shows adequate protection, and put a written agreement in place (since Sep 2023).✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Before collecting, tell people about any technology that identifies, locates or profiles them (e.g., ad cookies) and how to activate it; these functions must be off by default. Public tech products must use the highest privacy settings by default, except cookie settings.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Administrative monetary penalties up to C$10M or 2% of worldwide turnover (whichever is greater); penal fines up to C$25M or 4% of worldwide turnover for enterprises (C$5,000-C$100,000 for individuals).	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

Quebec Law 25: Enterprises that collect, hold, use or communicate personal info in the course of carrying on business in Quebec.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under Quebec Law 25

Designate and publish the person in charge of personal information (default: the CEO).
Adopt and publish governance policies and a plain-language privacy policy.
Do a privacy impact assessment before sending personal info outside Quebec and sign a written agreement.
Report confidentiality incidents with risk of serious injury to the CAI and affected people; keep an incident register.
Disclose use of identification, location or profiling technologies and how to turn them on.
Tell people when a decision is made solely by automated processing and explain it on request.

Full Quebec Law 25 page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.