When Did Law 25 Come Into Force? Complete 2022-2024 Timeline

"When does Law 25 come into force?" The question still comes up, and the answer deserves to be stated plainly: Law 25 has been fully in force since September 22, 2024. Every obligation applies today, with no exceptions and no grace period.

The confusion comes from the three-wave rollout that stretched from 2022 to 2024. This guide presents the complete timeline, wave by wave, and serves as a reference for placing each obligation in time.

Why a Staged Rollout

Law 25 (formally, the Act to modernize legislative provisions as regards the protection of personal information, assented to on September 22, 2021) profoundly transformed Quebec privacy law. The legislator chose a rollout over three successive anniversaries to give organizations time to adapt: September 2022, September 2023, and September 2024.

That adaptation time has now passed. An organization discovering the law today gets no additional delay: it is behind.

Wave 1: September 22, 2022

The first wave laid the governance foundations:

Designation of the privacy officer. By default, the role falls to the person with the highest authority (CEO, executive director), who can delegate it in writing. The privacy officer's contact information must be published on the website.
Confidentiality incident reporting. Obligation to keep an incident register and to notify the CAI and affected individuals when an incident presents a risk of serious injury.
Disclosure of biometric databases. Any creation of a database of biometric characteristics or measurements must be declared to the CAI.
Communication of information without consent in commercial transactions (business sale, merger): specific conditions now govern these exchanges.
Communication of information for study or research purposes: a new framework.

Wave 2: September 22, 2023

The second wave is the largest. It is the one that transformed organizations' daily operations:

Governance and transparency

Adoption of governance policies and practices for personal information, published in clear and simple terms on the website
Information at collection: purposes, means, access and rectification rights, the option to withdraw consent

Consent

Strengthened consent rules: manifest, free, informed, given for specific purposes, requested in clear and simple terms, and separately from any other information
Express consent required for sensitive information
Specific framework for minors under 14 (consent from the holder of parental authority)

Assessments and transfers

Mandatory PIA for any project to acquire, develop, or overhaul a system involving personal information
Mandatory PIA before any communication outside Quebec (section 17), with the adequate protection requirement and a written agreement

New rights and frameworks

Exclusively automated decisions (section 12.1): information, explanation, and the right to submit observations
Location, identification, and profiling technologies: prior information and deactivation means
De-indexing: the right to have information stop being disseminated or to have a hyperlink de-indexed under certain conditions
Destruction or anonymization of information whose purpose is fulfilled (section 23)
Contractual framework for service providers (section 18.3)
Privacy by default: the parameters of technological products and services offered to the public must provide the highest level of confidentiality by default

Sanctions

Coming into force of administrative monetary penalties (up to $10M or 2% of worldwide turnover) and the strengthened penal regime (up to $25M or 4%)
Punitive damages of at least $1,000 for unlawful and intentional infringements

Wave 3: September 22, 2024

The third wave completed the picture with one major element:

The right to data portability. Any person can request that the computerized personal information they provided be communicated to them in a structured, commonly used technological format, or transferred to another organization or authorized person.

This right requires organizations to be able to extract and transmit the information a person provided in a reusable format (CSV, JSON, or another standard structured format).

Summary Table

| Date | Main obligations | |---|---| | Sept. 22, 2021 | Assent (no immediate obligations) | | Sept. 22, 2022 | Privacy officer, incident register and notification, biometrics, commercial transactions | | Sept. 22, 2023 | Governance policies, strengthened consent, PIAs, section 17 (outside Quebec), section 18.3 (vendors), automated decisions, de-indexing, destruction/anonymization, sanctions | | Sept. 22, 2024 | Data portability |

What This Means in 2026

Every obligation has been in force for over a year and a half. Three practical consequences:

The "we are in transition" argument no longer holds. The CAI granted its pedagogy period during the rollout. Expectations are now at operational compliance.
Citizen complaints involve enforceable rights. A person requesting data portability, the de-indexing of a link, or access to their file is exercising a right in force, with firm response deadlines.
Track record counts. An organization inspected in 2026 with no privacy officer and no register cannot plead novelty: those obligations date from 2022.

For organizations starting now, the priority is not to catch up on the waves in historical order, but to build the foundations in logical order: privacy officer, inventory, policies, registers, then the continuous processes (PIAs, access requests, vendor management).

How Observantia Helps

Observantia covers the obligations of all three waves in a single platform: wave 1 registers, wave 2 PIAs and governance, wave 3 portability request tracking. For an organization catching up, the templates structure the setup in the right order. Start your 14-day free trial.

This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.