Who Does Law 25 Apply To? Scope and Exceptions

"Does Law 25 apply to us?" The question comes up constantly, and the myths are everywhere: too small to be covered, exempt as a nonprofit, safe because the business is in Ontario. Most of these ideas are wrong.

This guide draws the precise boundaries of Law 25's scope: who is covered, who is not, and the nuances for borderline cases.

The General Rule

Law 25 modernizes two acts, and the scope depends on which one covers you:

The private sector falls under the Act respecting the protection of personal information in the private sector (P-39.1). It applies to any person carrying on an enterprise within the meaning of article 1525 of the Civil Code of Quebec who collects, holds, uses, or communicates personal information.
The public sector falls under the Act respecting access to documents held by public bodies (A-2.1): ministries, municipalities, health institutions, school service centres, Crown corporations.

The Civil Code's notion of "enterprise" is broad: any organized economic activity, whether commercial or not, profit-seeking or not. In practice, almost any organization that produces goods or services in an organized way carries on an enterprise.

No Size Threshold

This is the most important point to remember: Law 25 has no size threshold. No minimum employee count, no minimum revenue, no minimum data volume.

| Organization | Covered? | |---|---| | Freelancer with a client list | Yes | | Two-person online store | Yes | | 50-employee SME | Yes | | Private physiotherapy clinic | Yes | | Multinational established in Quebec | Yes |

The obligations apply in full to all of these organizations. The law does provide implicit calibration: "reasonable security measures" and the depth of PIAs are assessed against the sensitivity of the information, the purpose, the quantity, the distribution, and the medium. A 3-person organization does not need a bank's program, but it needs a program.

Nonprofits: Covered in Most Cases

The idea that a nonprofit escapes Law 25 is widespread and generally wrong. The test is carrying on an enterprise within the meaning of the Civil Code, and the case law recognizes that an organized economic activity can be non-profit.

A nonprofit that employs staff, delivers services, collects dues or fees, or keeps a list of members or donors is almost certainly carrying on an enterprise. Professional associations, structured community organizations, sports clubs with employees, and foundations generally fall within scope.

Borderline cases exist (small volunteer groups with no organized economic activity), but the prudent position for any structured nonprofit is to consider itself covered.

Organizations Outside Quebec

Law 25 does not stop at the border. An organization established elsewhere (Toronto, Vancouver, New York, Paris) that collects personal information from people located in Quebec while carrying on an enterprise in Quebec can be covered.

The indicators of coverage: a transactional site actively selling into Quebec, marketing targeted at Quebec, a French version aimed at the Quebec market, Quebec customers served in an organized, recurring way.

An Ontario business whose occasional Quebec customers buy without any targeting sits in a grey zone. A business actively developing the Quebec market should comply.

The Real Exceptions

The exceptions to the scope are few and narrow.

Journalistic, historical, or genealogical material collected, held, used, or communicated for the legitimate information of the public is excluded. This exception protects media work; it does not cover the commercial activities of a media business (subscriptions, advertising, marketing).

Information for strictly personal use is not covered: your personal address book, your family photos.

Information that is public by law (public registers such as the Registraire des entreprises) follows lighter rules for consultation, but reusing it for other purposes remains regulated.

Business contact information in some contexts: a person's name, title, and professional contact details in the course of their duties get lighter treatment for certain business communications. This nuance does not remove the information from the law's scope; it eases certain consent obligations in B2B contexts.

That is essentially all. There is no small-business exception, no nonprofit exception, no exception for organizations that "don't sell data."

Frequent Borderline Cases

Franchisees. Each franchisee carrying on their own enterprise is responsible for their own compliance. The franchisor is responsible for the processing it performs itself (central loyalty program, national marketing).

Professionals governed by an order. Lawyers, accountants, physicians in private practice: covered by Law 25 on top of their ethical obligations. The two regimes apply in parallel.

Condo syndicates. Case law and the literature tend to treat them as carrying on an enterprise for their management activities. The prudent position is to comply.

Political parties. Governed by specific rules under the Election Act, amended in parallel with Law 25.

Federal undertakings (banks, telecommunications, interprovincial transportation) fall mainly under federal PIPEDA for their core activities. The exact split warrants legal advice. Our article Law 25 vs PIPEDA details this boundary.

You Are Covered: What That Means

If your organization falls within the scope (and if you are reading this from a Quebec organization, it almost certainly does), the core obligations are the same for everyone:

Designate a privacy officer and publish their contact information
Adopt governance policies and practices
Keep a register of confidentiality incidents
Conduct PIAs for high-risk projects and transfers outside Quebec
Honor individual rights (access, rectification, withdrawal, portability)
Destroy or anonymize information that is no longer needed

The scale of the program adjusts to your reality. The existence of the program is not negotiable.

How Observantia Helps

Observantia adapts to the size of the organization: registers, PIAs, and policies are built from templates calibrated for Quebec SMEs, without the weight of enterprise platforms. Start your 14-day free trial.

This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.