Quebec's Law 25 (formerly Bill 64, amending the province's Private Sector Act) is, on every measure that matters, the strictest privacy law in Canada. It phased in over three years — September 2022, 2023, and 2024 — and its enforcement powers dwarf anything else in the country, including PHIPA.
The obligations, phase by phase
Phase 1 (22 September 2022): New rules permitting certain communications without consent — largely a technical adjustment, not the substance of the law.
Phase 2 (22 September 2023) — where the real obligations start:
- A mandatory, named privacy officer, with the title and contact information published. Absent a written delegation, the highest-ranking person in the organization holds this role by default — which in practice means the owner-physician in most small clinics, whether they know it or not.
- Mandatory notification to the Commission d'accès à l'information (CAI) and to affected individuals of any confidentiality incident presenting a "risk of serious injury" — treated in practice as a 72-hour clock. See the full breach-response timeline across provinces.
- A mandatory incident register, maintained on an ongoing basis regardless of whether any single incident clears the notification threshold.
- Mandatory Privacy Impact Assessments (PIAs) before any project involving personal information — including, explicitly, any transfer of data outside Quebec.
- Clear, free, informed, and specific consent, plus plain-language transparency about what data is collected and why.
Phase 3 (22 September 2024): The right to data portability — patients can request their information in a structured, commonly used format.
The penalties are not close to anything else in Canada
Law 25 runs two separate penalty tracks, both far above PHIPA's ceilings:
- Administrative monetary penalties: up to $10M or 2% of worldwide turnover, whichever is greater.
- Penal fines: up to $25M or 4% of worldwide turnover, whichever is greater — doubled for repeat offences.
For comparison, PHIPA's administrative monetary penalties top out at $500,000 for organizations. Law 25's ceiling is fifty times higher.
As of this writing, no specific named CAI monetary penalty — company, amount, and date — has been publicly confirmed in the health sector. That is not the same as low enforcement risk: the CAI stopped publishing its public list of incident reports as of 27 May 2025, moving to aggregate statistics only, which makes the absence of a headline case harder to read as an absence of enforcement activity.
The out-of-province trap
The single most-missed fact about Law 25: it is not a Quebec-only law in practice. It reaches any organization offering goods or services to, or monitoring, Quebec residents — regardless of where the clinic itself is located. An Ontario-based virtual-care provider with Quebec patients, or a multi-province clinic network with even one Quebec-facing location, is in scope.
A separate track for the Quebec public health network
Quebec's public-network health institutions are governed by a distinct statute, the Act respecting health and social services information, in force since 1 July 2024, with its own penalty scale ($1,000–$150,000 per infraction for legal persons). Private clinics should confirm which regime actually classifies them — the two run on different rules.
Does Law 25 apply to my clinic if we're not in Quebec?
Yes, if you offer services to Quebec residents or monitor their behaviour (for example, through a website or patient portal accessible to Quebec-based patients). Physical location in Quebec is not the test — where your patients are is.
Why this is the biggest gap in most compliance tooling
Most compliance platforms built for the Canadian healthcare market were designed around Ontario's PHIPA and stop there. A clinic network with any Quebec footprint needs a platform that treats Law 25's PIA requirement, incident register, and 72-hour clock as first-class workflows — not an afterthought bolted onto an Ontario-first product.
Sources: CAI Québec — Principaux changements (Loi 25) · Osler — Law 25 enforcement scheme · McCarthy Tétrault — Law 25 update, obligations effective September 2023 · BCLP — Law 25's out-of-province reach · Gowling — CAI stops publishing incident reports · Blakes — Act respecting health and social services information.
Keep reading: The first 72 hours after a privacy breach · Ontario's first PHIPA fine: what the IPC found missing · take the free PHIPA scorecard