Does Quebec's Law 25 apply to my app?
If your app collects personal information about people in Quebec in the course of business, Law 25 is likely to apply to that information, even if your company is elsewhere in Canada. It requires a person in charge of privacy with published contact details, privacy impact assessments before transfers outside Quebec, an incident register, and notice when decisions are made exclusively by automated processing. This is general information, not legal advice.
Requirements that affect an AI app
| Duty | In practice |
|---|---|
| Person in charge of privacy | Named, with title and contact on your site |
| Assessment before transfer outside Quebec | Covers sending data to US-hosted AI providers |
| Automated decision notice | Tell people, explain factors, allow human review |
| Confidentiality incidents | Report serious ones, keep a register of all |
| Privacy by default | Most privacy-protective settings on by default |
Language
Quebec's language laws also affect consumer-facing apps. Check the French-language requirements separately.
First steps for a small team
- Decide who is the person in charge of protecting personal information, delegate it in writing if not the CEO, and publish the title and contact details on your website.
- Map what personal information you collect from Quebec residents and where it goes, including AI and hosting providers outside Quebec.
- Complete a privacy impact assessment for transfers outside Quebec.
- Set the most privacy-protective settings as defaults in the product.
- If any decision about a person is made exclusively by automated processing, add a notice and a way to ask for human review.
- Start a confidentiality incident register.
None of these depend on the app being built with AI tools. They do get harder to answer if nobody knows what the AI-generated code sends where, which is one more reason to have the data flows reviewed.
Getting it checked
TrazTech offers AI and LLM security assessments, listed from $4,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.
Related questions
- Does sending data to OpenAI break PIPEDA?
- What happens if my app leaks data?
- Privacy law for AI apps in Canada
Get a scope for your app
Tell us what you built, what it stores and who is about to use it.
Get matchedCommon questions
My company is in Ontario. Does Law 25 apply?
It can apply to Quebec residents' information you collect. Many companies simply apply its standard to everyone.
What are the penalties?
Administrative monetary penalties and penal fines under Law 25 can be significant, up to percentages of worldwide turnover for the most serious offences.