Law 25 vs PIPEDA: Which Law Applies to Your Organization?

Many Quebec organizations wonder whether they fall under Quebec's Law 25 or the federal Personal Information Protection and Electronic Documents Act (PIPEDA). The question comes up especially for businesses operating across provinces, carriers, financial institutions, and subsidiaries of Canadian groups.

The short answer: for the vast majority of businesses established in Quebec, Law 25 applies. But the overlap zones are real, and the two regimes differ on points with practical consequences. This guide walks through them.

The Two Regimes in Brief

PIPEDA is Canada's federal private-sector privacy law. In force since 2001, it applies to organizations that collect, use, or disclose personal information in the course of commercial activities. It is overseen by the Office of the Privacy Commissioner of Canada (OPC).

Law 25 (which modernizes the Act respecting the protection of personal information in the private sector, P-39.1) is Quebec's law. It applies to enterprises carrying on business in Quebec. It is overseen by the Commission d'accès à l'information (CAI).

Which Law Applies to Your Organization?

The allocation rule works like this:

Law 25 applies to private-sector organizations carrying on an enterprise in Quebec, for the personal information they handle in Quebec. The Quebec regime is recognized as "substantially similar" to the federal law, which displaces PIPEDA for intraprovincial activities.

PIPEDA applies in three main cases:

Federal works and undertakings (federally chartered banks, telecommunications, interprovincial transportation, aviation), even when established in Quebec, for their core activities and their employees' information
Interprovincial and international transfers of personal information in the course of commercial activities
Commercial activities in provinces without a substantially similar law (Ontario, for example, has no general private-sector law)

Both laws can apply simultaneously to the same organization. Common example: a Montreal business selling online across Canada falls under Law 25 for its Quebec activities and under PIPEDA for its customers in other provinces.

In practice, for a Quebec organization, the simplest strategy is to comply with Law 25, which is more demanding on almost every front. An organization compliant with Law 25 meets nearly all of PIPEDA's requirements.

Comparison Table

| Dimension | Law 25 (Quebec) | PIPEDA (federal) | |---|---|---| | In force | 2022-2024 (in stages) | 2001 (breach notification: 2018) | | Regulator | CAI | OPC | | Designated officer | Privacy officer mandatory for every organization | Accountable person required (Principle 1), less detailed | | Publication of the officer | Mandatory (website) | Not explicitly required | | PIA | Mandatory (high-risk projects, transfers outside Quebec) | Not mandatory (best practice) | | Breach notification | CAI + affected individuals if risk of serious injury | OPC + individuals if real risk of significant harm | | Breach register | Mandatory, 5 years | Mandatory, 24 months | | Automated decisions | Regulated (section 12.1) | Not specifically regulated | | Data portability | Yes (since Sept. 2024) | No | | De-indexing | Yes | No | | Administrative penalties | Up to $10M or 2% of worldwide turnover | None (recommendation powers only) | | Penal sanctions | Up to $25M or 4% of worldwide turnover | Fines up to $100,000 (specific offences) | | Private right of action | Yes (punitive damages possible) | Limited (Federal Court after OPC findings) |

The Differences That Matter in Practice

1. The Strength of Sanctions

This is the most dramatic gap. The federal OPC has no power to impose financial penalties; it investigates, publishes findings, and can recommend. Quebec's CAI can impose administrative monetary penalties up to $10 million or 2% of worldwide turnover, and penal prosecution can bring the total to $25 million or 4%.

Practical consequence: the real financial risk for a Quebec organization sits on the Law 25 side.

2. The Breach Register

Both laws require a register, but the retention period differs: five years under Law 25, twenty-four months under PIPEDA. An organization subject to both regimes applies the longer period.

3. The Notification Thresholds

The tests resemble each other ("risk of serious injury" in Quebec, "real risk of significant harm" federally) but are not identical. An incident affecting people in Quebec and elsewhere in Canada can require dual notification: to the CAI and to the OPC. The two regulators' forms and expectations differ.

4. The Rights PIPEDA Does Not Have

Data portability, de-indexing, and the regulation of automated decisions exist in Law 25 and have no PIPEDA equivalent. A pan-Canadian organization that aligns its processes on Law 25 therefore offers all of its Canadian customers rights the federal law does not require, which simplifies operations.

5. The Pending Federal Reform

Federal Bill C-27 (the Consumer Privacy Protection Act) aimed to modernize PIPEDA with sanctions comparable to Quebec's and Europe's. Its adoption has been delayed several times. Until the reform is in force, the gap between the two regimes remains. Organizations that comply with Law 25 now are de facto preparing for the future federal standard.

Practical Cases

Service SME based in Quebec City, Quebec clientele. Law 25 only. PIPEDA plays no practical role.

Montreal online store, sales across Canada. Law 25 for the core; PIPEDA for customers outside Quebec. Strategy: apply Law 25 everywhere, and check the dual-notification obligations for any incident affecting customers outside Quebec.

Quebec subsidiary of a federal bank. PIPEDA for banking activities and employees; some related activities may fall under Law 25. This case justifies legal advice.

Interprovincial carrier based in Laval. Federal undertaking: PIPEDA for the core business. Law 25 can apply to ancillary activities.

How Observantia Handles Both Regimes

Observantia is structured around Law 25, the more demanding regime. The incident register keeps documentation for five years (covering the federal 24-month requirement), and the notification fields document the notices sent to the CAI and the OPC when both apply. Start your 14-day free trial.

This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.