{"id":592,"slug":"quebec-law-25-sept-2024-data-portability-c25m-fines","title":"Quebec Law 25 (fully in force Sept 22, 2024): data portability + fines up to C$25M / 4% of worldwide turnover","kind":"reference","scope":"business","status":"current","audiences":["kevin","claude-code","smb-owner","candid-team"],"topics":["data-portability","regulatory-compliance"],"reference_body":"**Claim:** Quebec's **Law 25** (formerly Bill 64) is fully in force as of **September 22, 2024** (data portability phase).\n\n**Penalty schedule:**\n- **Administrative monetary penalties:** up to **C$10M or 2% of worldwide turnover**\n- **Penal fines:** up to **C$25M or 4% of worldwide turnover** for serious violations\n- **Private right of action:** individuals can sue with minimum **$1,000 damages**\n\n**Phased rollout:**\n- Sept 2022: DPO + breach notification\n- Sept 2023: PIAs, consent, most rights\n- **Sept 2024: data portability**\n\n**Sources:**\n- <https://outsidegc.com/blog/quebecs-privacy-law-25-what-you-need-to-know/>\n- <https://www.alation.com/blog/quebec-law-25-compliance-guide/>\n\n**Confidence:** Verified.\n\n**Scope for Ontario service businesses:** Law 25 applies extra-territorially to **any business serving Quebec residents**. Designate Privacy Officer, conduct PIAs before new systems or cross-border transfers, support data-portability requests in structured/machine-readable formats (CSV/JSON/XML — NOT PDFs), respond within ~30 days.\n\n**Compliance gap:** Per Axeptio (consent-management vendor), *\"fewer than 5% of Quebec's 255,000 SMEs are currently in compliance with Law 25\"* and *\"60% express no genuine intention to comply\"* as of the Sept 2024 deadline. **Single-source caveat** — vendor-published, directional. But the gap matches the GDPR rollout pattern.\n\nRelated: [[bill-c-15-canada-pipeda-mobility-2025]] (federal Bill C-15 proposes parallel data-mobility framework, tabled Nov 2025), [[eu-data-act-sept-2025-2027]] (EU equivalent).","rationale_body":null,"metadata":null,"links":{"outgoing":[{"slug":"pipeda-bill-c-27-died-january-2025","title":"Canadian privacy 2026: PIPEDA still governs; Bill C-27 died on the Order Paper Jan 6, 2025 — no fines, only findings","kind":"reference","scope":"business","link_type":"relates-to"},{"slug":"quebec-law-25-data-portability-sept-2024","title":"Quebec Law 25: data portability effective Sept 22, 2024; penalties up to C$25M / 4% of worldwide turnover","kind":"reference","scope":"business","link_type":"relates-to"}],"incoming":[{"slug":"rule-structured-data-is-privacy-compliance-accelerator","title":"RULE: Treat a deliberate data layer as a privacy-compliance accelerator, not a privacy risk. The scattered alternative is harder to comply with.","kind":"rule","scope":"business","link_type":"depends-on"},{"slug":"research-brief-dataset-is-the-product","title":"Research brief: The Dataset is the Product — when a service business should own its data (piece 12 of 15)","kind":"reference","scope":"business","link_type":"relates-to"}]},"created_at":"2026-05-22T20:37:13.214Z","updated_at":"2026-05-22T20:37:13.214Z"}