Law 25 Isn't Done With You: The Mid-Market Compliance Checklist

Updated September 25, 2026: every legal and factual statement in this article was re-checked against the primary source and corrected where needed.

If your organization heard about Québec's Law 25 back in 2023 and quietly filed it under "handled," it's worth another look. Law 25 phased in over three stages between September 2022 and September 2024, and the final piece — data portability — has been in force since September 22, 2024. For mid-market SaaS, fintech, and insurtech companies outside Québec that do business in Québec, even on a small scale, these obligations aren't new. They're current, enforceable, and backed by real penalty authority from the Commission d'accès à l'information (CAI).

In short: Law 25 has no minimum size threshold, and headquarters location is not the test: the CAI's position is that an organization located outside Québec is covered when it handles personal information in the course of its business activities in Québec. Every phase is now in force, including the six obligations this checklist covers — a designated and published privacy officer, a confidentiality incident register, privacy impact assessments (for new systems and for transfers outside Québec), privacy-by-default settings, automated-decision transparency, and data portability — and penal fines (up to $25 million CAD or, if greater, 4% of worldwide turnover) apply whether or not the company thinks of itself as a Québec business.

Québec's private-sector Act applies to personal information collected, held, used or communicated "in the course of carrying on an enterprise," and it sets no minimum threshold of Québec users or revenue. The CAI states that an organization located outside Québec is subject to the Act when it handles personal information in the course of its business activities in Québec. The Act itself doesn't draw a precise territorial line, so a SaaS platform in Toronto or Boston that serves Québec customers should plan on being in scope rather than assume it isn't. There's no "we're too small" exemption.

The obligations actually in force right now

Here's the checklist version — the questions a COO should be able to answer today, not someday:

• Privacy officer designated and published. By default, the person with the highest authority (typically the CEO) is automatically responsible for compliance. That can be delegated in writing to someone else — a privacy officer, general counsel — but the delegation must be documented, and that person's title and contact information published, usually on your website. If you can't point to where this lives publicly, it isn't done.
• Confidentiality incident register maintained. Every confidentiality incident, no matter how minor, gets logged in an internal register, kept for at least five years from when you became aware of it, and produced to the CAI on request. Notification to the CAI and affected individuals is only mandatory where the incident presents a risk of serious injury — but the register itself has no severity floor.
• Privacy impact assessments — for new systems and for data leaving Québec. Any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information needs a PIA, with your privacy officer consulted from the outset. Separately, before you communicate personal information outside Québec — or entrust a cloud vendor, an affiliate, or a subprocessor anywhere else with it — you need a PIA showing the information would receive adequate protection, in particular in light of generally recognized privacy principles, followed by a written agreement that reflects the PIA's results. The transfer rule applies to routine vendor relationships, not just headline-grabbing data sales.
• Privacy-by-default settings. If you collect personal information while offering the public a technological product or service that has privacy settings, those settings must provide the highest level of confidentiality by default — no digging through settings required. Privacy settings for browser cookies are excepted. Separately, any function that can identify, locate or profile a person must be disclosed up front, along with how to turn it on; the CAI reads this to mean those functions can't be on by default.
• Automated-decision transparency. If you use personal information to make a decision based exclusively on automated processing, you must tell the person no later than when you communicate the decision. On request, you must also tell them what personal information was used, the reasons and the principal factors and parameters behind the outcome, and that they have a right to have that information corrected. And they must be given the opportunity to submit observations to a member of your staff who is in a position to review the decision. Unlike Article 22 of the GDPR, which is limited to decisions with legal or similarly significant effects, the Québec rule has no such threshold. We covered the automated-decision rules in depth in our companion post on Canada's AI decision rules.
• Data portability. Since September 22, 2024, individuals can ask for computerized personal information collected from them to be communicated to them in a structured, commonly used technological format — or, at their request, to any person or body authorized by law to collect it. It's narrower than it sounds — computerized records only, not paper files; it doesn't reach information your systems created or inferred about someone; and it gives way where compliance would raise serious practical difficulties.

Run through that list honestly. If two or three items are shaky, close those first.

Penalties and reach

The exposure here is not symbolic. The CAI can levy administrative monetary penalties up to the greater of $10 million CAD or 2% of worldwide turnover for the prior fiscal year. Separately, penal proceedings can produce fines up to the greater of $25 million CAD or 4% of worldwide turnover — minimum corporate fine $15,000, doubled on repeat offence. Worldwide is the operative word: the calculation isn't limited to Québec or Canadian revenue. Combined with the reach described above, a law with "Québec" in the name is not a regional concern.

What to do this quarter

1. Confirm your privacy officer designation is current, documented in writing if delegated, and published where the public can find it.
2. Pull up your confidentiality incident register — or build one — and check the five-year retention is being met.
3. Inventory every place personal information tied to Québec individuals leaves your control: cloud hosting, subprocessors, affiliates, analytics. Flag any without a PIA behind them.
4. Create a new account or use your product as a first-time user and check whether privacy-adjacent settings default to on or off.
5. If you run any automated scoring, underwriting, or decisioning logic, confirm your process for notifying affected individuals and handling follow-up requests.

Mosaic runs Law 25 gap assessments using our own proprietary, standardized methodology, mapping each obligation above against your actual systems and vendor relationships rather than a generic checklist. Our team is expert-led throughout — the assessment, the findings, and the remediation plan come from people who've done this work before, not a template.

If your Law 25 posture hasn't been reviewed since 2023, that's the gap to close first — talk to Mosaic.