Quebec's Law 25 for early-stage software companies: what's in force, what the penalties really are, and the requirements most teams miss.
This article describes legal requirements; it is not legal advice.
Law 25 arrived in waves — September 2022, 2023, then 2024 — and many founders are still under the impression it was “a cookie thing”. Here is what it actually demands of a product handling information about people located in Quebec.
It applies to you even if you aren't in Quebec. The test isn't where you're headquartered, it's where the information comes from.●
An Ontario, French or Togolese company with Quebec users is subject to it.
1 · Designate a person in charge, and publish their name.
The simplest point, and the one most often missed. The law assigns the role by default to the person with the highest authority, and requires the title and contact details to be published on the site. A plain contact@ isn't enough: it has to be an identifiable person. Verifiable in thirty seconds by anyone, a regulator included.
2 · Keep a confidentiality incident register.
Every incident, not just the serious ones. And where one presents a risk of serious injury, you must notify the individuals concerned and the Commission d'accès à l'information without delay. The register has to exist before the incident: started the same day, it proves nothing.
3 · Assess before any transfer outside Quebec.
This is the section that catches early-stage software companies, because it isn't only about subcontracting: your host in Virginia, your newsletter tool in Ireland, your overseas support provider are each a communication outside Quebec. Each requires a prior privacy impact assessment.
4 · Default privacy settings to the highest protection.
For a product offering privacy settings, the most protective level must apply with no action from the user. A profile public by default with an option to make it private is a design-level non-compliance — and it doesn't fix well after launch.
5 · Make consent granular and revocable.
A single checkbox covering several purposes isn't consent. And refusing has to be as easy as accepting: the banner where Accept is a button and Refuse is a grey link on a second screen is exactly what the law targets.
6 · Enable portability.
Since September 2024, anyone may request their information in a structured, commonly used technological format. In practice: an export function. Plan it into the data model rather than adding it in a panic on the day of the first request.
7 · Declare biometrics sixty days ahead.
Little known, and strict. Any biometric database — facial recognition, fingerprints, voice authentication — must be declared to the Commission d'accès à l'information at least 60 days before it goes into service. If your roadmap includes facial recognition, that delay is a project milestone, not a formality.
The penalties, without the drama.
Administrative penalties can reach $10M or 2% of worldwide turnover; penal ones, $25M or 4%. Those ceilings target serious failures and will almost certainly never concern a five-person company.
The real risk for an early-stage company is elsewhere. The law opens a private right of action with punitive damages of at least $1,000 per person. On a base of ten thousand users, the arithmetic speaks for itself. And there's the commercial risk, more immediate: an institutional buyer will send you a security questionnaire. Not being able to answer adds three months to a sales cycle — or ends it.
The sequence if you're starting from zero.
Week 1: designate the person in charge, publish their contact details, open the incident register. Half a day, no budget. Week 2: inventory the data — which data, for what purpose, where it's hosted, how long you keep it. That's the foundation of everything else, and the only exercise that takes time.
Week 3: fix consent and the defaults in the product. Week 4: write the policy from the inventory — never the other way round. A policy written before the inventory describes an imaginary product, and becomes a non-compliance documented in writing, which is worse than having no policy.
The most common mistake.
Treating compliance as an end-of-project task. Granular consent, automatic purging, data export: these are data model decisions. Taken in week 1 they cost a few hours. Taken after launch they force a migration.