Quebec private-sector privacy law and Law 25 amendments

Section 3.3 requires privacy impact assessments for specified information-system projects. Section 17 requires a privacy impact assessment and a written agreement before communicating personal information outside Quebec, and applies the same rule when an enterprise entrusts collection, use, communication or keeping of the information to someone outside Quebec. Section 12.1 requires notice and related rights for decisions based exclusively on automated processing, including an opportunity to submit observations to a staff member able to review the decision. Next key date: none recorded. Last verified October 29, 2026.