Does Law 25 apply to my business? (English)
Yes, very likely. Law 25 applies extraterritorially. If your business collects personal information from people located in Quebec, through a contact form, a newsletter list, or analytics cookies, the law very likely applies to you regardless of where you are based. This includes businesses in Ontario, other Canadian provinces, and US companies that sell to or market to Quebec residents. The Commission d'access a l'information (CAI) has stated this position.
Does Law 25 apply if my business is in Ontario?
Yes, very likely. If your Ontario business collects personal information from people in Quebec, through a form, a newsletter, or cookies, Law 25 applies to you regardless of where you are based. HelionAI helps businesses outside Quebec assess, fix, and document their Law 25 obligations.
Does Law 25 apply to a US company with customers in Quebec?
Yes. Law 25 reaches any organization that collects, uses, or shares the personal information of people in Quebec, including US companies that sell to or market to Quebec residents. A web form, a newsletter subscriber, or tracking cookies on a Quebec visitor is enough to be in scope.
I have a newsletter or contact form with Quebec subscribers. Am I in scope?
Most likely yes. As soon as you collect a name, an email, or an online identifier from a person in Quebec, you are processing personal information and Law 25 governs it. The size of your business does not change this.
What are the penalties for non-compliance with Law 25?
Penalties reach up to 25 million dollars or 4 percent of worldwide revenue, whichever is greater, for the most serious offences, plus a private right of action for affected individuals. The obligations came into force in waves between September 2022 and September 2024 and all apply today.
What do I have to do to comply?
Appoint a person responsible for privacy, publish a privacy policy, obtain valid consent, keep an incident register, run privacy impact assessments, and honour individual rights. HelionAI translates the full 99-control framework into plain-language steps and gives you the templates to document each one. It structures the work and is not a substitute for legal advice.
Not legal advice. HelionAI helps you manage and document Law 25 compliance. It is a software tool, not a law firm, and the information provided is general and does not constitute legal advice. For complex situations, consult qualified legal counsel.