Quebec Law 25 (fully in force Sept 22, 2024): data portability + fines up to C$25M / 4% of worldwide turnover
Claim: Quebec's Law 25 (formerly Bill 64) is fully in force as of September 22, 2024 (data portability phase).
Penalty schedule:
- Administrative monetary penalties: up to C$10M or 2% of worldwide turnover
- Penal fines: up to C$25M or 4% of worldwide turnover for serious violations
- Private right of action: individuals can sue with minimum $1,000 damages
Phased rollout:
- Sept 2022: DPO + breach notification
- Sept 2023: PIAs, consent, most rights
- Sept 2024: data portability
Sources:
- https://outsidegc.com/blog/quebecs-privacy-law-25-what-you-need-to-know/
- https://www.alation.com/blog/quebec-law-25-compliance-guide/
Confidence: Verified.
Scope for Ontario service businesses: Law 25 applies extra-territorially to any business serving Quebec residents. Designate Privacy Officer, conduct PIAs before new systems or cross-border transfers, support data-portability requests in structured/machine-readable formats (CSV/JSON/XML — NOT PDFs), respond within ~30 days.
Compliance gap: Per Axeptio (consent-management vendor), "fewer than 5% of Quebec's 255,000 SMEs are currently in compliance with Law 25" and "60% express no genuine intention to comply" as of the Sept 2024 deadline. Single-source caveat — vendor-published, directional. But the gap matches the GDPR rollout pattern.
Related: Canadian Bill C-15 (tabled Nov 4, 2025) — proposes data-mobility framework for federal PIPEDA (federal Bill C-15 proposes parallel data-mobility framework, tabled Nov 2025), EU Data Act (Regulation 2023/2854): SaaS switching procedures effective Sept 2025; switching fees abolished by Sept 2027 (EU equivalent).