Quebec Law 25 for Software Companies: What to Build Into Your Product

Quebec Law 25 for software companies is mostly discussed as a legal and cookie banner topic, but much of the work lands on the product itself. Law 25 is the common name for the 2021 law (Bill 64) that overhauled Quebec's private-sector privacy act. Its rules came into force in three stages, in September 2022, 2023 and 2024, so all of it now applies. If people in Quebec use your software, here is what the law means for what you build, and what to ask your team or development firm.

Who it applies to

The law applies to businesses that collect, hold, use or share personal information in the course of carrying on business. It can also apply to software companies based in Ontario, elsewhere in Canada or the United States that sell to Quebec customers or collect information from people in Quebec. If you are not sure whether it applies to you, ask your lawyer. If your customers are Quebec businesses, expect them to ask you about it either way, because they stay responsible for personal information their vendors handle for them, and the law requires a written contract setting out how the vendor protects it.

What it means for the product

Several Law 25 rules turn directly into product features. If you sell to Quebec businesses, many of these duties belong to your customer, but your product has to make them possible:

1. Privacy by default. If you offer a product to the public and it has privacy settings, they must be set to the highest level of privacy by default. Browser cookie settings are excluded from this rule, but cookies used for tracking can still fall under the tracking rules below.
2. Clear, separate consent. Where consent is needed, it must be requested in clear and simple terms, for each specific purpose, and in writing it must be presented separately from other information. A single "I agree" box covering everything will not do.
3. Tracking features. If your product can identify, locate or profile a person, you must tell them, and tell them how to turn those functions on. Because the law speaks of turning them on, they are generally read as being off until the person turns them on.
4. Data export. Since September 2024, a person can ask for the computerized personal information collected from them (not information you created or inferred) in a structured, commonly used technological format, unless that raises serious practical difficulties. New systems must be built to allow this, so an export feature is far easier than a manual job each time.
5. Deletion and de-indexing. People can ask you to stop spreading their information or to de-index links to it in some cases. When information is no longer needed for its purpose, it must be destroyed or anonymized under the criteria set by Quebec's anonymization regulation.
6. Incident records. Every confidentiality incident must be recorded in a register, and those that present a risk of serious injury reported. Your software needs logs good enough to tell what happened and whose information was involved.
7. Access controls. Only staff who need personal information for their work may access it. Access logs are a sensible way to show you meet this and the law's general duty to protect information.

Privacy impact assessments and data leaving Quebec

Law 25 requires a privacy impact assessment for any project to build, buy or overhaul a system or electronic service delivery that involves personal information. Your development process needs a step for this, and your team needs to supply the technical answers.

A privacy impact assessment is also required before personal information is sent outside Quebec, including to another Canadian province. That covers hosting, backups and outside services built into your product, such as email, analytics, support tools and payment providers, when they are outside Quebec. The transfer also needs a written agreement that reflects the assessment. Keep a current list of where personal information goes. Your Quebec customers will ask for it.

Incidents and penalties

If a confidentiality incident presents a risk of serious injury, the business must promptly notify the Commission d'accès à l'information, which is Quebec's privacy regulator, and the people affected. Every incident, serious or not, goes in the register, and the Commission can ask to see it.

The penalties are among the highest in Canada. The Commission can impose administrative penalties of up to $10 million or 2% of worldwide turnover, whichever is greater. Fines for offences can reach $25 million or 4% of worldwide turnover. People can also sue for damages. Where a breach is intentional or results from gross fault and causes harm, courts must award punitive damages of at least $1,000.

Law 25, PIPEDA and PHIPA

Software teams in Canada often have to deal with more than one privacy law:

1. Law 25 covers personal information handled by private-sector businesses in Quebec, and can reach businesses elsewhere that serve people in Quebec.
2. PIPEDA is Canada's federal private-sector privacy law. It covers most commercial activity in provinces without their own similar law, such as Ontario, and personal information that crosses provincial or national borders.
3. PHIPA is Ontario's health privacy law. It covers health information handled by Ontario health information custodians, such as health care providers, and the agents and service providers who work for them.

Much of the product work overlaps: access controls, logs, export, deletion and clear records of where data goes. Build these once and design them to meet the strictest of the laws that apply to you, which is often Law 25.

Ten questions to ask your team or development firm

1. If we offer the product to the public, are its privacy settings set to the most private option by default?
2. How do we, or our customers, ask for consent in the product, and is each purpose asked separately?
3. Does any feature identify, locate or profile users, and is it off until the user turns it on?
4. Can we, or our customers, export a person's information in a structured, common format without a developer?
5. How do we delete or anonymize information we no longer need?
6. What would our logs tell us if there were a privacy incident tomorrow?
7. Who inside our company can see personal information, and can we prove it?
8. Where is personal information hosted and backed up, and which outside services receive it?
9. Is there a step in our development process for privacy impact assessments?
10. What documents can we give a Quebec customer who sends us a privacy questionnaire?

If several answers are vague, that is your list of work.

How we approach it

NorthSight Technologies is a software development company in Ontario, Canada. We build and fix software for teams whose customers ask hard questions about privacy and security. Senior engineers scope the work and write the code. We build privacy settings, consent handling, data export, deletion and incident logging into the product, and we prepare the technical records a privacy officer or customer will ask to see. We do not give legal advice, and we work alongside your privacy officer or lawyer.

If you are working through Quebec Law 25 for your software company and want a straight answer on what your product needs, we offer a free 20-minute call. You can read how we work and book the call on our software development and compliance page.

Also published on LinkedIn →