Quebec (Canada)
Full entry AI-checked Checked 5 November 2026
Read this together with Canada, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Act respecting the protection of personal information in the private sector | CQLR c P-39.1 | In force | 1 January 1994 |
- Act respecting the protection of personal information in the private sector: Modernised by Law 25 (Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25), which took effect in stages from September 2022 to 22 September 2024. Federal CASL governs e-marketing (see ca).
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The Act applies to anyone carrying on an enterprise who collects, holds, uses or communicates personal information, whatever the medium. Journalistic, historical and genealogical material is excluded. Its collection and confidentiality rules (Divisions II and III) don’t apply to information that is public by law or to work contact details. PIPEDA (see ca) still applies in Quebec to federally regulated businesses and to data crossing provincial or national borders.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-info…
Lawful bases
Section titled “Lawful bases”Consent-based. Set purposes before collecting, collect only what’s necessary, and tell people the purposes, means, their rights and whether data may leave Quebec. Consent must be clear, free, informed, specific and asked for separately for each purpose. Using data for a new purpose needs consent, express for sensitive data, unless an exception applies. People can access, correct and get portable copies of their data, and ask for de-indexing. Once the purposes are met, destroy the data, or anonymise it for serious and legitimate uses under the 2024 anonymisation regulation.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · legisquebec.gouv.qc.ca/en/document/rc/A-2.1, r. 0.1 · cai.gouv.qc.ca/uploads/pdfs/CAI_Criteres_Validite_Consentement.pdf · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
Consent age for online services
Section titled “Consent age for online services”Personal information about a child under 14 can’t be collected from the child without consent from a parent or tutor, unless collecting it is clearly in the child’s interest. From 14, the minor, a parent or the tutor can give consent.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/uploads/pdfs/CAI_Criteres_Validite_Consentement.pdf
Children
Section titled “Children”Beyond the under-14 rule, general rules matter for children. Products and services offered to the public must have the highest privacy settings by default, and the CAI says identification, location and profiling functions must stay off until the person turns them on. Whether someone was a minor when information was published counts in de-indexing requests. A 2026 private member’s bill on screens and social media (Bill 796) was introduced but not passed before the legislature ended.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine… · assnat.qc.ca/en/travaux-parlementaires/projets-loi/projets-loi-43-3.html
Cookies and similar technologies
Section titled “Cookies and similar technologies”Before collecting data with technology that can identify, locate or profile a person, tell them it’s used and how to turn those functions on. The CAI says such functions can’t be on by default. The highest-privacy-by-default rule doesn’t apply to browser cookie settings. Anyone collecting personal information through technological means must publish a confidentiality policy in clear and simple language on its website, if it has one. Federal CASL rules on installing software also apply (see ca).
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
Electronic marketing
Section titled “Electronic marketing”Federal CASL governs commercial electronic messages (see ca). On top, using personal information for commercial or philanthropic prospecting needs consent, because it isn’t a purpose consistent with the original collection. When prospecting, identify yourself, tell people they can withdraw consent, and stop using their data for it when they do.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1
Breach notification
Section titled “Breach notification”If a confidentiality incident (unauthorised access, use or communication, loss, or any other breach of protection) presents a risk of serious injury, promptly notify the CAI and the people affected, and take steps to reduce the risk. Weigh sensitivity, likely consequences and likelihood of misuse. Keep a register of every incident for at least five years and give the CAI a copy on request.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · legisquebec.gouv.qc.ca/en/showdoc/cr/A-2.1, r. 3.1
Registration and fees
Section titled “Registration and fees”No general registration. Tell the CAI in advance before verifying identity with biometrics, which also needs the person’s express consent, and disclose a biometric database at least 60 days before it goes into service. Personal information agents, who build files on people and sell credit reports, must register with the CAI and pay the prescribed fee.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/C-1.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine… · legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1
Data protection officer
Section titled “Data protection officer”The person with the highest authority in the enterprise is in charge of protecting personal information and can delegate the role in writing. Publish that person’s title and contact details on your website. Adopt governance policies covering retention, staff roles and complaints, approved by that person, and publish plain-language information about them.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
International transfers
Section titled “International transfers”Before communicating personal information outside Quebec, or having it handled outside Quebec, do a privacy impact assessment that weighs sensitivity, purpose, safeguards and the destination’s legal framework. Go ahead only if it shows adequate protection, and under a written agreement. Tell people at collection if their data may leave Quebec.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
Impact assessments
Section titled “Impact assessments”Do a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service involving personal information, consulting the person in charge from the start, and keep it proportionate to sensitivity and volume. Assessments are also required before data leaves Quebec and before disclosing it without consent for research.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
Automated decisions and AI
Section titled “Automated decisions and AI”If a decision is based only on automated processing, tell the person no later than when you tell them the decision. On request, explain the information used and the main reasons and factors, let them correct the information, and let them submit observations to a staff member who can review the decision.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaine…
Penalties
Section titled “Penalties”The CAI can impose administrative penalties up to $10 million or 2% of worldwide turnover, whichever is higher, or accept an undertaking instead. Penal fines for enterprises run from $15,000 to $25 million or 4% of worldwide turnover, doubled for repeat offences. People can sue, and courts must award at least $1,000 in punitive damages where an unlawful infringement causing injury is intentional or grossly negligent.
Sources: legisquebec.gouv.qc.ca/en/showdoc/cs/P-39.1 · cai.gouv.qc.ca/uploads/pdfs/CAI_Cadre_Sanct_Pecun.pdf
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/ca-qc.yaml.