Quebec Law 25In forceCanada · Quebec

Quebec Law 25 — Act respecting the protection of personal information in the private sector (automated decision provisions)

Last reviewed Sep 25, 2026.

In short

Quebec's Law 25 modernised the province's private-sector privacy law with GDPR-style duties. Three rules matter most for AI. When a decision about a person is made exclusively by automated processing, you must tell them by the time of the decision and, on request, explain the information and main factors used, let them correct data and make representations to a human. When technology profiles, locates or identifies people, you must say so and offer to deactivate it. A privacy impact assessment is required for new systems handling personal information.

Who it applies to

Organisations that build or use AI systems in Canada · Quebec.
Use cases in scope: profiling & scoring, hiring & HR, credit & lending, insurance, general use.
Size: everyone, including solo operators.
Applies to any enterprise handling personal information of people in Quebec; section 12.1 bites when a decision is based exclusively on automated processing.

Key dates

Sep 22, 2022✓First phase in force (privacy officer, breach reporting)
Sep 22, 2023✓Automated-decision (s. 12.1), profiling notice (s. 8.1) and privacy impact assessment duties in force
Sep 22, 2024✓Data-portability right in force

What you have to do

Flag every decision about a person that is made solely by an algorithm and notify them no later than when you communicate the decision.
Be ready to explain, on request, the personal information used, the main factors and parameters, and the person's right to correct data.
Provide a route to have observations reviewed by a human who can change the decision.
Tell people when profiling, location or identification technology is used and how to turn it off.
Run a privacy impact assessment before building or buying a system that processes personal information.
Appoint a privacy officer and publish your policies in plain language.

Penalties

Administrative monetary penalties of up to C$10 million or 2% of worldwide turnover, and penal fines of up to C$25 million or 4% of worldwide turnover, whichever is greater. A private right of action for punitive damages also exists.

Related lessons

Level 1The world map of AI rules: EU, US patchwork, Canada, standards8 min
Level 2Build your AI inventory6 min
Level 2Data and privacy basics for AI7 min
Level 2Transparency and disclosure: telling people AI is involved7 min
Level 3Human oversight that actually works6 min
Level 3Documenting decisions: records and impact assessments7 min
Level 4Incident response and monitoring7 min
Level 5Preparing for enforcement, investigations and appeals7 min

Real cases

Settlement2024 · US-federal
Louis v. SafeRent — $2.275 million settlement over algorithmic tenant scoring
Settlement approved by the court on 20 November 2024: SafeRent pays $2.275 million (up to $1.175 million to class members) and, for five years, will not produce a SafeRent Score or accept/deny recommendation for applicants using housing vouchers unless a fair-housing expert validates a new model. The court awarded $1.1 million in attorneys' fees.
Ruling2026 · CA-federal
Canadian privacy regulators v. OpenAI — joint findings on ChatGPT training data
Complaint well-founded. The federal OPC treated it as conditionally resolved on the strength of OpenAI's commitments (filtering tools, clearer notices about accuracy and sources, improved access tools, quarterly reporting); the Quebec, BC and Alberta offices found the consent and retention issues unresolved. No fine was imposed — PIPEDA gives the OPC no penalty powers.

Industries where it matters

Sources

Last reviewed Sep 25, 2026.