{ "jurisdiction_id": "CA-QC", "jurisdiction": "Canada – Quebec", "url": "https://dataprotection.gi/jurisdictions/canada-quebec/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 50, "sub_modules": 57, "source_register": 18 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Comprehensive, fully-in-force omnibus private-sector statute with an active, well-resourced supervisory authority; only minor gaps in extraterritorial-scope statutory clarity.", "claims": [ { "statement": "The Commission d'accès à l'information du Québec (CAI) is Quebec's provincial data protection authority responsible for overseeing compliance with the Act Respecting the Protection of Personal Information in the Private Sector.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "Quebec's data-protection regime is anchored in the Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as substantially amended by An Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25 / Law 25, formerly Bill 64).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "Law 25 entered into force in three phases beginning September 22, 2022, with the final phase (data portability) taking effect September 22, 2024, at which point the Act is fully in force.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "Biometric-specific obligations are separately set out in Quebec's Act to Establish a Legal Framework for Information Technology, which Law 25 amended to require 60 days' advance notice to the CAI before a biometric database is brought into service.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null }, { "statement": "Quebec's Act Respecting Health and Social Services Information (LRSSS) entered into effect July 1, 2024, establishing a health-sector-specific personal information protection regime.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "The Private Sector Act governs the collection, retention, use, access to, and transfer of personal information by private enterprises carrying on business in Quebec.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "CAI guidance indicates both Canadian and foreign companies offering goods or services in Quebec are expected to comply with its consent framework, signalling an extraterritorial-facing application of the Private Sector Act to organizations serving Quebec residents.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "Organizations must disclose to the CAI, at least 60 days in advance, the creation of any database containing biometric characteristics or measurements before it is brought into service.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "green", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent and sensitive-data rules are mature and CAI has published detailed guidance; lawful-basis enumeration is less granular than GDPR.", "claims": [ { "statement": "Organizations must determine the purposes for collecting personal information and may collect only the information necessary for those purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "Consent requests must be presented separately from other information requests and must be clear, free and informed, with express consent required for sensitive personal information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "Sensitive personal information under Quebec law includes medical, biometric, or otherwise intimate information, and information may also become sensitive where the context of its use or communication entails a high reasonable expectation of privacy.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Organizations must obtain express consent before using sensitive personal information for secondary purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Under Law 25, personal information is 'de-identified' if it no longer allows direct identification of the person concerned, whereas information is 'anonymized' only if it irreversibly no longer allows the person to be identified directly or indirectly.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null }, { "statement": "Anonymization of personal information must be performed for serious and legitimate reasons and according to generally accepted best practices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iapp-cps-23-forthcoming-quebec-privacy-regulations-situate-province-between-canada-and-europe", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Full suite of rights now in force including portability as of the final 2024 phase; deadlines are codified.", "claims": [ { "statement": "Organizations must, on request, confirm the existence of personal information, communicate it, and provide a copy to the individual concerned.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "The Private Sector Act provides individuals a right to access and rectification of their personal information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "Section 28.1 creates a right to de-indexing ('right to be forgotten') requiring cessation of dissemination or de-indexing of a hyperlink where dissemination causes serious injury to reputation or privacy that outweighs the public interest in the information or freedom of expression.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "Individuals have a right to contest an automated decision and request human review, analogous to Article 22(3) GDPR.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "The right to data portability was the final phase of Law 25 to take effect, entering into force on September 22, 2024.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "An individual's request to exercise access or rectification rights must be responded to within 30 days.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Strong DPIA/breach/security/retention coverage (green-level), but ROPA and joint-controller concepts are not codified in equivalent GDPR form, warranting an amber overall rating.", "claims": [ { "statement": "Organizations must conduct a privacy impact assessment before adopting technology that processes personal information and before transferring personal information outside Quebec.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iapp-cps-23-forthcoming-quebec-privacy-regulations-situate-province-between-canada-and-europe", "source_tier": null, "observed_at": null }, { "statement": "Organizations must adopt and publish privacy governance policies and practices according to prescribed requirements, approved by the person in charge of protecting personal information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "By default, the highest authority (e.g., CEO) of an organization is responsible for compliance with the Private Sector Act, but this responsibility may be delegated in writing to any person, whose name, title and contact information must be published.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Enterprises must take security measures necessary to protect personal information that are reasonable given the sensitivity of the information, its purposes, quantity, and the medium on which it is stored.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/quebec-data-breach", "source_tier": null, "observed_at": null }, { "statement": "Organizations must notify the CAI and affected individuals of any confidentiality incident presenting a 'risk of serious injury,' assessed under real-risk-of-significant-harm factors.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Organizations must maintain a register of confidentiality incidents and conduct a lessons-learned/remediation review to help prevent recurrence.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Organizations must destroy personal information once it is no longer required for the purposes for which it was collected, a duty that may be satisfied through anonymization.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "amber", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "Robust TIA obligation is in force, but the absence of published adequacy lists and localisation clarity leaves cross-border compliance more case-specific than in EU-style regimes.", "claims": [ { "statement": "Section 17 requires organizations to conduct a transfer/privacy impact assessment before transferring personal information outside Quebec, assessing sensitivity, purpose, and the adequacy of protection at the destination, including equivalent obligations on subsequent third-party recipients.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iapp-cps-23-forthcoming-quebec-privacy-regulations-situate-province-between-canada-and-europe", "source_tier": null, "observed_at": null }, { "statement": "Organizations relying on contractual safeguards to meet Section 17's outside-Quebec transfer requirement must bind subsequent third-party recipients to equivalent data-protection obligations, functioning similarly to standard contractual clauses.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iapp-cps-23-forthcoming-quebec-privacy-regulations-situate-province-between-canada-and-europe", "source_tier": null, "observed_at": null }, { "statement": "A Quebec transfer impact assessment must consider the sensitivity of the information, the purpose of the transfer, and whether the information will receive adequate protection once transferred, including from third parties who may subsequently access it.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/iapp-cps-23-forthcoming-quebec-privacy-regulations-situate-province-between-canada-and-europe", "source_tier": null, "observed_at": null } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Health overlay is well-evidenced (green-level); most other sectors carry no confirmed Quebec-specific overlay, driving an overall amber/gap rating.", "claims": [ { "statement": "The Act Respecting Health and Social Services Information (LRSSS), effective July 1, 2024, establishes a health-and-social-services-specific personal information regime intended to protect such information while enabling its use to improve service quality.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "The CAI has issued guidance advising employers on best practices for handling personal information in recruitment, including responsible use of AI tools in hiring.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Strong privacy-by-default and marketing-consent coverage, but no evidence of signal-based opt-out or cross-context-advertising-specific rules.", "claims": [ { "statement": "By default, organizations must configure products and services so that functions enabling identification, location, or profiling of an individual are deactivated unless the individual actively opts in.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/quebecs-bill-64-the-first-of-many-privacy-modernization-bills-in-canada", "source_tier": null, "observed_at": null }, { "statement": "Manipulative design patterns such as oversized opt-in buttons and addictive engagement incentives are flagged by Canadian privacy regulators, including Quebec's CAI, as inconsistent with privacy-by-default and best-interest-of-young-persons principles.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/about-the-opc/what-we-do/provincial-and-territorial-collaboration/joint-resolutions-with-provinces-and-territories/res_231005_01/", "source_tier": null, "observed_at": null }, { "statement": "Where personal information is used for marketing ('prospection') purposes, the organization must communicate the identity of the party using the information and inform individuals of their right to withdraw consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Biometric and profiling/ADM transparency rules are mature (green-level) but AI-specific risk-assessment obligations for the private sector and surveillance carveouts remain unconfirmed.", "claims": [ { "statement": "Profiling is a defined concept under Law 25, requiring organizations to give advance notice of technology that creates a profile of an individual and the means to deactivate that function where available.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "Individuals subject to a decision based exclusively on automated processing of their personal information must be informed of the information used, the principal reasons and factors, and their right to have the decision reviewed, with a right to contest and request human review.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "Unlike Article 22 GDPR, Law 25 does not prohibit solely automated decision-making outright; it instead imposes a notification and contestation requirement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null }, { "statement": "Quebec's public-sector AI framework (the 'MCN') sets out ten principles for responsible AI use by public bodies covering compliance, equity, security and transparency.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null }, { "statement": "Quebec's Act to Establish a Legal Framework for Information Technology requires express consent to verify identity using biometric measurements, limits collection to minimum necessary characteristics, and restricts decisions based on other information revealed via biometric processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null }, { "statement": "Following 23andMe's bankruptcy, the CAI publicly reminded Quebec residents of their rights over genetic data and urged individuals to manage consent or request deletion of their genetic information.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Parental consent threshold is well-evidenced (green-level) but age-verification, education-settings, and dependent-adults sub-modules are unconfirmed gaps.", "claims": [ { "statement": "Personal information concerning a minor under 14 may not be collected without the consent of a parent or legal guardian, unless collection is clearly for the minor's benefit.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "The CAI has urged stricter rules to protect minors' personal information, including prohibiting its commercial use and prioritizing children's best interests in data-processing decisions.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/quebec", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "green", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/canada-quebec/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Active, uniquely well-empowered regulator with recent (within-180-day) enforcement activity and a codified private right of action; funding/capacity and collective-redress specifics remain unconfirmed gaps.", "claims": [ { "statement": "The CAI may issue notices of noncompliance and impose administrative monetary penalties of up to $25 million or, if greater, 4% of worldwide turnover for the preceding year for organizations (or up to $50,000 for individuals), with lesser administrative sanctions of $10 million or 2% of turnover for other violations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation", "source_tier": null, "observed_at": null }, { "statement": "Quebec's CAI is currently the only Canadian privacy regulator empowered to impose administrative monetary penalties, and it can proactively verify organizational compliance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/", "source_tier": null, "observed_at": null }, { "statement": "In a joint investigation with the federal OPC and the BC and Alberta privacy commissioners, the CAI found that OpenAI had not adequately documented how it fulfilled the duty to inform or obtained consent from individuals in connection with ChatGPT training data, and that disclosures for the free web version were insufficient.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/", "source_tier": null, "observed_at": null }, { "statement": "The CAI found that, under Quebec's Private Sector Act, default privacy settings for OpenAI's models should have provided the most privacy-protective option, i.e., that user chats would not be used for model training by default.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-002-overview/", "source_tier": null, "observed_at": null }, { "statement": "Law 25 creates a private right of action allowing individuals to seek compensation for unlawful infringement of a right conferred by the Private Sector Act or the privacy provisions of the Civil Code of Québec, with punitive damages of at least $1,000 available for intentional or grossly-faulty infringements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/", "source_tier": null, "observed_at": null }, { "statement": "On May 6, 2026, the CAI joined the federal OPC and the BC and Alberta privacy commissioners in releasing a joint report of findings concluding that OpenAI's early ChatGPT models were not compliant with their respective privacy laws, leading OpenAI to implement new safeguards.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Office of the Privacy Commissioner of Canada", "source_url": "https://www.priv.gc.ca/en/opc-news/news-and-announcements/2026/bg-info_openai_260506/", "source_tier": null, "observed_at": null }, { "statement": "On February 23, 2026, the CAI joined a multinational joint statement of data protection and privacy authorities addressing AI-generated imagery and its implications for privacy.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Office of the Privacy Commissioner of Canada (hosting joint statement)", "source_url": "https://www.priv.gc.ca/en/opc-news/speeches-and-statements/2026/js-dc_20260223_ai/?wbdisable=true", "source_tier": null, "observed_at": null } ] } ] }