--- title: "Quebec, Canada Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/quebec-canada/ source_html: /jurisdictions/quebec-canada/index.html description: "Quebec, Canada data protection and privacy regulation: 10 categories, 81 claims, updated 2026-11-04." generated_at: 2026-11-07T14:58:19Z content_sha256: e6233ab58ba121eb4015f03d11ffd93ebf83e477d4c837aa5ee2a4243d08604a generator: "fe-fleet/md-twin@1.0" --- # Quebec, Canada Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Quebec, Canada Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed hybrid regime overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 81 claims · 36 sources in the cumulative register Download report (PDF) Expand all Quebec's Commission d'accès à l'information issued a decision this cycle prohibiting Metro Inc. from putting into service a biometric-characteristics database. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Data Subject Rights, Sectoral Watch, Algorithmic, Biometric & Surveillance Governance, Enforcement & Redress (5 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=QUEBEC-CANADA)[Build Report](/reports/?j=QUEBEC-CANADA)[Compare](/compare/?j=QUEBEC-CANADA) Framework posture Hybrid regime 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Commission d'accès à l'information du Québec (CAI) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 81 Claims 11 Tier-1 sources Traffic-light mix 4 green 6 amber (sums to 10 rendered categories; click to filter) No red categories; 19 sub-modules are flagged red. Canada federal law that applies in Quebec, Canada is covered once, on the [Canada](/jurisdictions/canada/) page. This page covers Quebec, Canada’s own layer: its own law, regulators and enforcement. ## Jurisdiction brief Jurisdiction lead brief 941 Full executive summary 562 ###### Latest update · 25 October 2026 #### Lead Signal The Court of Quebec confirmed, in a decision rendered on 23 September 2026 and announced by the province's privacy regulator on 16 October 2026, the regulator's order requiring Clearview AI Inc. to cease collecting facial-recognition data on Quebec residents without consent and to destroy the resulting biometric identifiers. The court rejected Clearview's challenge to the applicability of Quebec's private-sector privacy framework and information-technology legal framework to its activities. This is a confirmed judicial outcome, not merely a regulatory order standing on its own, and it closes off - at least for now - the specific jurisdictional argument Clearview had advanced against the regulator's authority to act against an entity whose facial-recognition database practices reached into the province without a Quebec-based physical presence. #### Other Developments The province's privacy regulator has been active on several fronts beyond the Clearview matter. On 22 October 2026 it published new guidance addressing deceptive-design interfaces - so-called dark patterns - and their effect on personal-information protection, following its quinquennial report, which recommended that such interfaces be legislatively prohibited where they affect personal-information protection. The same quinquennial report also recommended, as reform directions rather than enacted rules, greater legal accounting for algorithmic inferences drawn about individuals and special protections tailored to young people. None of these three items - the dark-patterns guidance, the algorithmic-inference recommendation, or the youth-protection recommendation - has yet been translated into a binding legislative amendment; each currently sits as regulator guidance or reform advocacy. Separately, commentary indicates the regulator has held administrative-monetary-penalty power since September 2023 under the province's privacy-modernisation statute, with ceilings reaching the greater of $25 million Canadian dollars or four percent of worldwide turnover for the most serious or repeated violations, yet no administrative monetary penalty has been published as having been issued under that power to date. #### Cross-Monitor Connections The Clearview enforcement confirmation and the regulator's dark-patterns and algorithmic-governance recommendations touch on surveillance and automated-inference practices that also bear on the province's broader artificial-intelligence governance posture; the artificial-intelligence monitor is the more appropriate venue for any assessment of the underlying facial-recognition or inference technology itself, and this brief does not attempt that analysis here. #### Outlook The Clearview confirmation sets a precedent, at least at the provincial court level, for the regulator's jurisdiction over out-of-province facial-recognition operators whose data practices affect Quebec residents, and is likely to be cited in future enforcement matters involving biometric or surveillance technology providers without a local establishment. Whether the three reform recommendations from the quinquennial report - on dark patterns, algorithmic inference, and youth protection - advance into an actual legislative amendment will be the more consequential question to track over coming periods, since recommendation and enactment carry materially different weight for organisations currently operating on the basis of the existing statute. Equally notable is the continued absence of any published administrative monetary penalty more than three years after the regulator acquired that power, which raises the question of how the power sits against both the Clearview matter and the recommended expansions should the reforms proceed, even though no such penalty had actually issued as at the time of this review. 1 earlier update not shown here. ###### Standing brief · as of 4 September 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Quebec's Commission d'accès à l'information issued a decision this cycle prohibiting Metro Inc. from putting into service a biometric-characteristics database. This is a concrete enforcement precedent rather than a change to the statutory text of Law 25, and it demonstrates that the province's biometric-processing rules carry active supervisory teeth beyond what the statute alone would suggest. The decision is Confirmed via a Tier-1 CAI source and represents this cycle's clearest signal of regulatory activity within Quebec's fully phased-in private-sector data-protection regime. #### Other Developments Statutory penalty ceilings remain a live enforcement backdrop. The CAI may impose administrative monetary penalties of up to ten million Canadian dollars or two percent of worldwide turnover, with penal prosecution reaching twenty-five million dollars or four percent of worldwide turnover for the most serious or repeat violations; individuals also hold a separate private right of action for damages. These ceilings, confirmed via Law 25's enforcement provisions, are the framework within which the Metro Inc. biometric decision and any future enforcement actions are assessed, though the precise sanction, if any, attached to the Metro Inc. matter is not detailed in available evidence this cycle. Cross-border transfer rule scope remains partly uncorroborated. The core Law 25 requirement that a privacy impact assessment precede any communication of personal information outside Quebec has been in force since 22 September 2023 and is Confirmed. Secondary vendor commentary describes a further 2026 tightening that would require a PIA even for transfers to previously "adequate" destinations, but this expansion could not be corroborated against a CAI primary source this cycle, and is accordingly treated as Uncertain pending independent verification. #### Cross-Monitor Connections Quebec's biometric-database enforcement activity is relevant to the financial-integrity monitor's tracking of identity-verification and KYC infrastructure to the extent any biometric database serves compliance purposes for regulated financial entities, though this cycle's evidence does not establish that connection for the Metro Inc. matter specifically. No further cross-monitor linkage is evidenced this cycle. #### Outlook Whether further CAI enforcement actions follow the Metro Inc. biometric decision, and whether any monetary penalty is eventually disclosed in connection with that matter, are the key near-term markers to track. Separately, independent verification of the claimed 2026 cross-border transfer tightening against a CAI primary source, rather than vendor commentary alone, would resolve this cycle's principal evidentiary gap in the cross-border and adequacy domain. Read full brief · 941 words ###### Latest update · 4 November 2026 #### Regulatory Status Quebec's privacy regulator, the Commission d'acces a l'information, used its June 2026 quinquennial report to raise concerns about its own institutional capacity under Law 25's expanded mandate, recommending both budgetary oversight by the National Assembly and a shift from statutory appeals to the Court of Quebec toward judicial review before the Superior Court. Separately, the Commission is reported to have found Law 25 applicable extraterritorially to OpenAI in a joint investigation concluded in May 2026, a reported finding not yet corroborated by a published primary decision. On algorithmic and biometric governance, the Commission remains active through corrective enforcement rather than through a tested legal standard: section 12.1 on automated decision-making has drawn no interpreting decision as of October 2026, but biometrics enforcement has intensified, with a June 2026 decision ordering redaction or destruction of unnecessary social-insurance-number records within 30 days alongside governance-policy and reporting conditions. The Commission has also recommended that privacy-impact assessments for decision-making AI systems incorporate an algorithmic impact analysis. On enforcement more broadly, the Commission is reported not to have issued any administrative monetary penalty since gaining that power in September 2023, relying instead on corrective orders. Private litigation is progressing on a separate track, with the Court of Appeal's hearing on leave to appeal the Zenleads class-action authorisation against the Apollo.io operator scheduled for November 2026. #### Outlook The nearer-term events to watch are the Court of Appeal's November 2026 hearing in the Zenleads/Apollo.io matter and whether a primary decision confirming the Commission's reported extraterritorial finding against OpenAI surfaces. Longer-term, whether the Commission's institutional-reform recommendations are taken up by the National Assembly, and whether it moves from corrective orders to its first monetary penalty, will shape how Law 25 enforcement actually operates relative to its statutory design. ###### Standing brief · as of 25 October 2026 #### Regulatory Status Quebec's privacy regime is in a period of active enforcement combined with reform advocacy rather than legislative change. The Court of Quebec's confirmation, on 23 September 2026, of the privacy regulator's order against Clearview AI Inc. - requiring cessation of unconsented facial-recognition collection and destruction of resulting biometric identifiers - rejected a jurisdictional challenge to the applicability of the province's private-sector privacy and information-technology statutes, reinforcing the regulator's reach over out-of-province biometric-technology operators whose practices affect Quebec residents. Alongside this, the regulator's quinquennial report put forward three reform recommendations not yet enacted: a legislative prohibition on deceptive-design interfaces affecting personal-information protection, greater legal accountability for algorithmic inferences about individuals, and special protections for young people. New guidance on deceptive-design interfaces, published 22 October 2026, accompanies the dark-patterns recommendation as an interim interpretive position. Separately, no administrative monetary penalty has yet been published under the regulator's penalty power, held since September 2023. #### Outlook The Clearview confirmation is the clearest and most consequential development of the period, setting a judicially-confirmed precedent for the regulator's authority over out-of-province biometric-data operators. The three reform recommendations - on dark patterns, algorithmic inference, and youth protection - remain at the advocacy stage, and their progression toward actual legislative amendment, or lack of it, is the central item to track going forward, alongside whether the continued absence of a published administrative monetary penalty persists even as enforcement activity (via court-confirmed orders rather than monetary penalties) continues. Read full brief · 562 words Key regulatory facts for Quebec, Canada Regulatory Dimension Quebec, Canada Standing Position Jurisdiction Quebec, Canada (CA-QC) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 81 sourced findings) Regulator & Framework Comprehensive, fully-in-force omnibus private-sector statute with an active, well-resourced supervisory authority; only minor gaps in extraterritorial-scope statutory clarity. Lawful Processing & Special Data Consent and sensitive-data rules are mature and CAI has published detailed guidance; lawful-basis enumeration is less granular than GDPR. Data Subject Rights Full suite of rights now in force including portability as of the final 2024 phase; deadlines are codified. Controller/Processor Duties Strong DPIA/breach/security/retention coverage (green-level), but ROPA and joint-controller concepts are not codified in equivalent GDPR form, warranting an amber overall rating. Primary Instruments Cited DataGuidance, Office of the Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada, Gowling WLG, Quebec, Canada Official Instrument (cai.gouv.qc.ca www-cai-gouv-qc-ca) Last Confirmed / Updated 2026-11-04 (36 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Quebec, Canada: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, fully-in-force omnibus private-sector statute with an active, well-resourced supervisory authority; only minor gaps in extraterritorial-scope statutory clarity. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 (SQ 2021, c. 25) Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Green Comprehensive, fully-in-force omnibus private-sector statute with an active, well-resourced supervisory authority; only minor gaps in extraterritorial-scope statutory clarity. #### Sub-modules (5) #### Regulator And AuthorityGreen CAI is the sole provincial DPA overseeing the Private Sector Act, with inquiry, order-making and sanctioning powers. Claims (3): - The Commission d'accès à l'information du Québec (CAI) is Quebec's provincial data protection authority responsible for overseeing compliance with the Act Respecting the Protection of Personal Information in the Private Sector. - Commission d'acces a l'information du Quebec (CAI) — The sole supervisory authority for the private-sector personal-information-protection regime in Quebec. - Commission d'acces a l'information du Quebec (CAI) — Placing the CAI's budget under National Assembly oversight to safeguard independence, and replacing statutory appeals to the Court of Quebec with judicial review before the Superior Court, citing insufficient resources for its expanded Law 25 mandate. #### Act And InstrumentsGreen Core instrument is the Private Sector Act as amended by Law 25; biometrics and health-sector data carry dedicated overlay instruments. Claims (6): - Quebec's data-protection regime is anchored in the Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as substantially amended by An Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25 / Law 25, formerly Bill 64). - Law 25 entered into force in three phases beginning September 22, 2022, with the final phase (data portability) taking effect September 22, 2024, at which point the Act is fully in force. - Biometric-specific obligations are separately set out in Quebec's Act to Establish a Legal Framework for Information Technology, which Law 25 amended to require 60 days' advance notice to the CAI before a biometric database is brought into service. - Quebec's Act Respecting Health and Social Services Information (LRSSS) entered into effect July 1, 2024, establishing a health-sector-specific personal information protection regime. - Loi 25 (Loi modernisant des dispositions legislatives en matiere de protection des renseignements personnels) — Fully in force since September 2024, phased in from September 2022; no amending instrument located this cycle. - Law 25 (Quebec private-sector Act) — No confirmed amending instrument to Law 25 was located for 2026; secondary commentary asserting a '2026 amendment' raising maximum AMP and tightening cross-border-transfer duties could not be corroborated against the CAI's own published news or Quebec's official gazette this cycle. #### Material ScopeGreen Applies to collection, retention, use, access and transfer of personal information by private enterprises carrying on business in Quebec. Claims (2): - The Private Sector Act governs the collection, retention, use, access to, and transfer of personal information by private enterprises carrying on business in Quebec. - Law 25 (Act Respecting the Protection of Personal Information in the Private Sector) — Any enterprise handling the personal information of Quebec residents, with no headcount or revenue threshold, a materially broader test than Alberta's or BC's PIPA. #### Territorial ScopeAmber Statutory extraterritorial reach is not as explicit as GDPR Art. 3, but CAI guidance signals expected application to foreign entities serving Quebec residents. Claims (2): - CAI guidance indicates both Canadian and foreign companies offering goods or services in Quebec are expected to comply with its consent framework, signalling an extraterritorial-facing application of the Private Sector Act to organizations serving Quebec residents. - Commission d'acces a l'information du Quebec (CAI) — OpenAI, despite the company having no establishment or employees in Quebec, in a joint investigation concluded May 2026. #### Regulator Registration And FilingAmber No general registration regime, but biometric-database creation must be pre-disclosed to CAI 60 days before deployment. Claims (2): - Organizations must disclose to the CAI, at least 60 days in advance, the creation of any database containing biometric characteristics or measurements before it is brought into service. - Law 25 section 45 — A biometric database (e.g. facial or voice templates) must be disclosed to the CAI at least 60 days before entering service. Quebec operates a comprehensive, GDPR-influenced private-sector data protection regime under the Act Respecting the Protection of Personal Information in the Private Sector (CQLR c P-39.1), as substantially amended by Law 25 (formerly Bill 64, SQ 2021 c.25), enforced by the Commission d'accès à l'information du Québec (CAI). A parallel Public Sector Act governs government bodies (out of scope here), and sector-specific instruments (biometrics IT Act, LRSSS) overlay the general regime. Law 25 entered into force in three phases from Sept. 2022 through full effect on Sept. 22, 2024. No periodic updates recorded in this cycle Sources and claims (15) - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — The Commission d'accès à l'information du Québec (CAI) is Quebec's provincial data protection authority responsible for overseeing compliance with the Act Respecting the Protection of Personal Information in the Private Sector. - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — Quebec's data-protection regime is anchored in the Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as substantially amended by An Act to modernize legislative provisions as regards the protection of personal information (SQ 2021, c. 25 / Law 25, formerly Bill 64). - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — Law 25 entered into force in three phases beginning September 22, 2022, with the final phase (data portability) taking effect September 22, 2024, at which point the Act is fully in force. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/) — Biometric-specific obligations are separately set out in Quebec's Act to Establish a Legal Framework for Information Technology, which Law 25 amended to require 60 days' advance notice to the CAI before a biometric database is brought into service. - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — Quebec's Act Respecting Health and Social Services Information (LRSSS) entered into effect July 1, 2024, establishing a health-sector-specific personal information protection regime. - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — The Private Sector Act governs the collection, retention, use, access to, and transfer of personal information by private enterprises carrying on business in Quebec. - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — CAI guidance indicates both Canadian and foreign companies offering goods or services in Quebec are expected to comply with its consent framework, signalling an extraterritorial-facing application of the Private Sector Act to organizations serving Quebec residents. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/opc-news/news-and-announcements/2020/qa_20200924/) — Organizations must disclose to the CAI, at least 60 days in advance, the creation of any database containing biometric characteristics or measurements before it is brought into service. - [Gowling WLG](https://gowlingwlg.com/en/insights-resources/articles/2026/cai-2026-quinquennial-report-and-its-implications-for-quebec-private-sector) — Loi 25 (Loi modernisant des dispositions legislatives en matiere de protection des renseignements personnels) — Fully in force since September 2024, phased in from September 2022; no amending instrument located this cycle. - [https://www.cai.gouv.qc.ca/](https://www.cai.gouv.qc.ca/) — Commission d'acces a l'information du Quebec (CAI) — The sole supervisory authority for the private-sector personal-information-protection regime in Quebec. - [Sherlock Forensics](https://www.sherlockforensics.com/blog/quebec-law-25-2026-amendments-canadian-organizations.html) — Law 25 (Quebec private-sector Act) — No confirmed amending instrument to Law 25 was located for 2026; secondary commentary asserting a '2026 amendment' raising maximum AMP and tightening cross-border-transfer duties could not be corroborated against the CAI's own published news or Quebec's official gazette this cycle. - [Gowling WLG](https://gowlingwlg.com/en/insights-resources/articles/2026/cai-2026-quinquennial-report-and-its-implications-for-quebec-private-sector) — Commission d'acces a l'information du Quebec (CAI) — Placing the CAI's budget under National Assembly oversight to safeguard independence, and replacing statutory appeals to the Court of Quebec with judicial review before the Superior Court, citing insufficient resources for its expanded Law 25 mandate. - [Clym](https://www.clym.io/blog/quebec-law-25) — Law 25 (Act Respecting the Protection of Personal Information in the Private Sector) — Any enterprise handling the personal information of Quebec residents, with no headcount or revenue threshold, a materially broader test than Alberta's or BC's PIPA. - [https://dev.to/codacon/quebec-law-25-and-generative-ai-what-to-settle-before-production-58j1](https://dev.to/codacon/quebec-law-25-and-generative-ai-what-to-settle-before-production-58j1) — Commission d'acces a l'information du Quebec (CAI) — OpenAI, despite the company having no establishment or employees in Quebec, in a joint investigation concluded May 2026. - [CAI](https://www.cai.gouv.qc.ca/) — Law 25 section 45 — A biometric database (e.g. facial or voice templates) must be disclosed to the CAI at least 60 days before entering service. ### Quebec, Canada: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Consent and sensitive-data rules are mature and CAI has published detailed guidance; lawful-basis enumeration is less granular than GDPR. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Green Consent and sensitive-data rules are mature and CAI has published detailed guidance; lawful-basis enumeration is less granular than GDPR. D2 · Lawful Processing — Full Module Record 4 sub-modules · 38 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Full suite of rights now in force including portability as of the final 2024 phase; deadlines are codified. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Green Full suite of rights now in force including portability as of the final 2024 phase; deadlines are codified. #### Sub-modules (5) #### Access RightGreen Organizations must confirm existence of, communicate, and provide copies of personal information on request. Claims (1): - Organizations must, on request, confirm the existence of personal information, communicate it, and provide a copy to the individual concerned. #### Rectification And ErasureGreen Access/rectification rights plus a de-indexing 'right to be forgotten' subject to a reputational-harm balancing test. Claims (3): - The Private Sector Act provides individuals a right to access and rectification of their personal information. - Section 28.1 creates a right to de-indexing ('right to be forgotten') requiring cessation of dissemination or de-indexing of a hyperlink where dissemination causes serious injury to reputation or privacy that outweighs the public interest in the information or freedom of expression. - Law 25 — Individuals may request that an organisation cease disseminating their personal information or de-index a hyperlink giving access to it, where dissemination causes prejudice or contravenes the law or a court order. #### Restriction And ObjectionGreen Individuals may contest automated decisions and request human review. Claims (1): - Individuals have a right to contest an automated decision and request human review, analogous to Article 22(3) GDPR. #### Data PortabilityGreen Portability right became effective in the final Law 25 implementation phase. Claims (2): - The right to data portability was the final phase of Law 25 to take effect, entering into force on September 22, 2024. - Law 25 — Since 22 September 2024, organisations must, on request, provide computerised personal information in a structured, commonly used technological format (data portability right). #### Deadlines And Response WindowsGreen Statutory 30-day response window applies to individual rights requests. Claims (1): - An individual's request to exercise access or rectification rights must be responded to within 30 days. Quebec grants GDPR-adjacent rights of access, rectification, a bespoke 'right to be forgotten' via de-indexing, contestation of automated decisions, and (as of Sept. 2024) data portability, with a 30-day statutory response window for access/rectification requests. Sources and claims (8) - [IAPP](https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation) — Organizations must, on request, confirm the existence of personal information, communicate it, and provide a copy to the individual concerned. - [DataGuidance](https://www.dataguidance.com/jurisdictions/quebec) — The Private Sector Act provides individuals a right to access and rectification of their personal information. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — Section 28.1 creates a right to de-indexing ('right to be forgotten') requiring cessation of dissemination or de-indexing of a hyperlink where dissemination causes serious injury to reputation or privacy that outweighs the public interest in the information or freedom of expression. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — Individuals have a right to contest an automated decision and request human review, analogous to Article 22(3) GDPR. - [Office of the Privacy Commissioner of Canada](https://www.priv.gc.ca/en/privacy-and-transparency-at-the-opc/proactive-disclosure/opc-parl-bp/ab_20240924/is_ab_20240924/) — The right to data portability was the final phase of Law 25 to take effect, entering into force on September 22, 2024. - [IAPP](https://iapp.org/news/a/a-quick-comparative-survey-of-quebecs-proposed-privacy-legislation) — An individual's request to exercise access or rectification rights must be responded to within 30 days. - [Clym](https://www.clym.io/blog/quebec-law-25) — Law 25 — Since 22 September 2024, organisations must, on request, provide computerised personal information in a structured, commonly used technological format (data portability right). - [Clym](https://www.clym.io/blog/quebec-law-25) — Law 25 — Individuals may request that an organisation cease disseminating their personal information or de-index a hyperlink giving access to it, where dissemination causes prejudice or contravenes the law or a court order. ### Quebec, Canada: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong DPIA/breach/security/retention coverage (green-level), but ROPA and joint-controller concepts are not codified in equivalent GDPR form, warranting an amber overall rating. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Strong DPIA/breach/security/retention coverage (green-level), but ROPA and joint-controller concepts are not codified in equivalent GDPR form, warranting an amber overall rating. D4 · Controller & Processor — Full Module Record 7 sub-modules · 43 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Robust TIA obligation is in force, but the absence of published adequacy lists and localisation clarity leaves cross-border compliance more case-specific than in EU-style regimes. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 (Section 17) Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Robust TIA obligation is in force, but the absence of published adequacy lists and localisation clarity leaves cross-border compliance more case-specific than in EU-style regimes. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 38 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Health overlay is well-evidenced (green-level); most other sectors carry no confirmed Quebec-specific overlay, driving an overall amber/gap rating. Primary framework Act Respecting Health and Social Services Information (LRSSS); Private Sector Act generally for other sectors Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Health overlay is well-evidenced (green-level); most other sectors carry no confirmed Quebec-specific overlay, driving an overall amber/gap rating. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 47 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong privacy-by-default and marketing-consent coverage, but no evidence of signal-based opt-out or cross-context-advertising-specific rules. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Strong privacy-by-default and marketing-consent coverage, but no evidence of signal-based opt-out or cross-context-advertising-specific rules. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 34 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric and profiling/ADM transparency rules are mature (green-level) but AI-specific risk-assessment obligations for the private sector and surveillance carveouts remain unconfirmed. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25; Act to Establish a Legal Framework for Information Technology (biometrics) Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Biometric and profiling/ADM transparency rules are mature (green-level) but AI-specific risk-assessment obligations for the private sector and surveillance carveouts remain unconfirmed. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance Quebec's regulator has been materially more active on biometrics than on automated decision-making proper, and the gap between the two is itself informative. Section 12.1 of Law 25, which addresses automated decision-making, remains, as of October 2026, without any Commission decision interpreting it directly. What exists instead is a proxy signal from the Commission's biometrics enforcement: its facial-recognition decision concerning Metro Inc., issued in April 2026, ordered six-monthly reporting for two years covering system effectiveness, false-positive rates and algorithmic bias. That reporting condition is a reasonable guide to the accountability standard the Commission would likely expect of an automated decision-making system under section 12.1 even though no such case has yet reached a decision. Biometric enforcement itself escalated this period. In a June 2026 decision — only the Commission's second biometrics ruling since 2021 — an enterprise was given 30 days to redact or destroy documents containing social insurance numbers found to be unnecessary to its purposes, and was separately required to adopt governance policies, disclose its practices on its public website, and report back to the Commission on compliance within 90 days. The pairing of a biometric data point with social-insurance-number handling in the same decision suggests the Commission is treating these as connected risk categories rather than isolated findings, and the short remediation and reporting windows it imposed are consistent with its approach in the Metro matter. On the forward-looking side, the Commission's June 2026 quinquennial report is understood to recommend that privacy-impact assessments for AI systems making decisions about individuals incorporate an algorithmic impact analysis, built out from the Commission's existing privacy-impact-assessment guide rather than a wholly new instrument. This is a recommendation, not a binding rule, but it signals the direction the Commission wants assessment practice to move in ahead of any section 12.1 decision actually testing the statute. #### Outlook The absence of a section 12.1 decision leaves genuine uncertainty about how the Commission will actually apply Law 25's automated-decision-making provisions once a case reaches it, though the reporting conditions imposed in the Metro and June 2026 biometrics matters give the clearest available indication of the accountability metrics the Commission is likely to demand. Organisations deploying biometric or algorithmic decision systems reaching Quebec residents should expect continued case-by-case enforcement through corrective orders in the near term, with the recommended algorithmic-impact-analysis addition to privacy-impact assessments a signal of where assessment expectations are heading rather than a present requirement. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance The most significant development in this area is judicial rather than legislative: the Court of Quebec, in a decision rendered on 23 September 2026 and announced by the province's privacy regulator on 16 October 2026, confirmed the regulator's order against Clearview AI Inc. The order requires Clearview to cease collecting facial-recognition data on Quebec residents without their consent and to destroy the biometric identifiers already collected. Clearview had challenged the applicability of Quebec's private-sector privacy framework and its information-technology legal framework to its operations, and the court rejected that challenge, confirming the regulator's authority to act notwithstanding Clearview's position that it fell outside the reach of those statutes. Separately, and at a different stage of development entirely, the regulator's quinquennial report recommended greater legal accounting for algorithmic inferences drawn about individuals as a direction for future legislative reform. This recommendation has not been enacted and should not be read as describing a current obligation; it describes a direction the regulator considers the law should move in, concerning how organisations that derive inferences about individuals through automated or algorithmic means should be held accountable for those inferences under privacy law specifically. #### Outlook The Clearview confirmation is likely to be influential well beyond the immediate case, since it establishes at the provincial court level that out-of-province or no-local-presence operators of facial-recognition and biometric-identification systems are reachable under Quebec's privacy and information-technology statutes where their data practices affect Quebec residents. Any other biometric or surveillance-technology provider operating without a Quebec establishment but processing Quebec residents' biometric data should treat this confirmation as a live precedent rather than a one-off result. The algorithmic-inference recommendation, by contrast, remains at the advocacy stage, and its progression toward an actual legislative amendment - or its stalling - is the item to track over the coming periods. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Cour du Quebec's confirmation on appeal, rendered 23 September 2026, of the Commission d'acces a l'information's 2021 order against Clearview AI Inc. is the principal development in Quebec's algorithmic and biometric governance posture within the observed window. The order, now judicially confirmed, holds that Clearview AI Inc. is subject to Quebec's private-sector privacy statute and to the Act to establish a legal framework for information technology, and must cease collecting facial images and creating biometric identifiers from them without consent in the course of carrying on an enterprise in Quebec, and must destroy images and identifiers already collected. Clearview is an out-of-province entity with no Quebec physical presence, so the central legal question on appeal was whether Quebec's privacy framework reaches an entity engaged in commercial facial-image scraping and biometric-database construction despite that absence of physical presence. The Court answered that question affirmatively. The Court's reasoning on the Charter dimension of the case is itself a significant governance marker. Clearview argued that the order restricted its freedom of expression under section 2(b) of the Canadian Charter and the equivalent Quebec Charter provision. The Court held that this restriction is minimal and is justified in a free and democratic society, weighing the beneficial effects of the restriction for the public interest and for privacy protection against its limited impact on expression. Legal-affairs commentary characterises the decision as an important and substantial one, specifically for its confirmation that Quebec's privacy statutes operate extraterritorially against commercial biometric-collection activity directed at Quebec residents from outside the province. This is a meaningful building block for any future enforcement action against out-of-jurisdiction entities engaged in similar facial-recognition or biometric-database activity touching Quebec residents, since it establishes, at the appellate level, that physical absence from the province does not place such activity beyond the Commission's order-making reach. Separately, but within the same governance space, Quebec's judiciary adopted institutional guidance on generative AI. The Court of Appeal, Superior Court, Court of Quebec and Municipal Courts jointly signed common guidelines on 31 August 2026, published 4 September 2026, addressing judges' use of generative AI tools. The guidelines state that generative AI should not be used for substantive legal reasoning, fact analysis or qualification, or evidentiary assessment, framing judging as a fundamentally human act that generative tools should not substitute for. This is judicial-administration guidance internal to the courts rather than a private-sector or general-public AI obligation, and it does not itself create a binding rule applicable to organizations subject to Quebec's private-sector privacy statute. It is nonetheless indicative of an institutional caution toward delegating consequential, rights-affecting determinations to automated or AI-assisted processes, a posture that sits alongside, and is broadly consistent with, the extraterritorial-reach holding in the Clearview matter regarding automated biometric processing of personal data. Taken together, these two developments describe a Quebec algorithmic-governance environment that is actively defining the boundaries of acceptable automated and biometric processing of personal information, whether undertaken commercially (Clearview) or institutionally (judicial AI guidelines), with the former now carrying the weight of an appellate confirmation. #### Outlook The Clearview AI decision, now confirmed at the Cour du Quebec level, is likely to be cited as a leading authority for the extraterritorial reach of Quebec's private-sector privacy statute against out-of-jurisdiction biometric-data collectors, absent a further appeal. Organizations engaged in facial-recognition, biometric-identifier creation or similar automated-identification activity touching Quebec residents from outside the province should expect this precedent to inform future CAI enforcement postures. The judicial generative-AI guidelines, being confined to internal court administration, are not expected to generate a parallel private-sector obligation in the near term, though they may inform the tenor of future CAI guidance on automated decision-making more broadly. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 65 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Parental consent threshold is well-evidenced (green-level) but age-verification, education-settings, and dependent-adults sub-modules are unconfirmed gaps. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Amber Parental consent threshold is well-evidenced (green-level) but age-verification, education-settings, and dependent-adults sub-modules are unconfirmed gaps. D9 · Children's Privacy — Full Module Record 5 sub-modules · 42 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Quebec, Canada: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Active, uniquely well-empowered regulator with recent (within-180-day) enforcement activity and a codified private right of action; funding/capacity and collective-redress specifics remain unconfirmed gaps. Primary framework Act Respecting the Protection of Personal Information in the Private Sector, CQLR c P-39.1, as amended by Law 25 Supervisory authority [Commission d'accès à l'information du Québec (CAI)](https://www.cai.gouv.qc.ca/) Traffic-light rationale — Green Active, uniquely well-empowered regulator with recent (within-180-day) enforcement activity and a codified private right of action; funding/capacity and collective-redress specifics remain unconfirmed gaps. Periodic update · new data 2026-11-04 #### Enforcement & Redress The statutory penalty exposure under Law 25 has not changed but is worth restating as context for the enforcement pattern observed below: sections 90.1 and 91 set administrative monetary penalties of up to the greater of CAD10 million or 2% of worldwide turnover for less-serious violations, and penal fines of up to the greater of CAD25 million or 4% of worldwide turnover for serious violations. Those ceilings place Law 25 in the same register as the GDPR's penalty architecture. What stands out is how little of that exposure has actually been used. As of October 2026, the Commission is reported not to have published a single administrative monetary penalty despite having held that power since September 2023. Its enforcement record to date is said to consist of corrective orders — the redaction, destruction, governance-policy and reporting conditions seen in its biometrics decisions — rather than monetary sanctions. That reported absence has not been independently verified against the Commission's own decisions register this period and should be read as attributed rather than confirmed, but if accurate it marks a meaningful gap between the Commission's statutory powers and its exercised practice three years into having them. Private redress is moving on a separate and more active track. In Zenleads inc. (2026 QCCS 5), the Quebec Superior Court authorised a class action against the operator of the Apollo.io sales-prospecting platform on 5 January 2026. The Court of Appeal has since granted leave to appeal that authorisation, with a hearing scheduled for November 2026. The matter is a test of how Quebec's civil courts, rather than the Commission, will handle large-scale commercial data-collection claims under Law 25's private-sector regime, and the outcome of the leave-to-appeal hearing will bear on how readily similar authorisations are granted in future matters. #### Outlook Two threads are worth separating going forward. On the regulatory side, whether the Commission issues its first administrative monetary penalty would be a significant marker of a shift from corrective-order practice toward the financial-sanction regime the statute already permits, though no such penalty has surfaced to date. On the judicial side, the Court of Appeal's November 2026 hearing in the Zenleads/Apollo.io matter is the nearer-term event, and its outcome will indicate how class-action authorisation under Law 25 is likely to be treated at the appellate level going forward. Periodic update · new data 2026-10-25 #### Enforcement & Redress The defining enforcement development this period is the Court of Quebec's confirmation, in a decision rendered 23 September 2026 and announced by the regulator on 16 October 2026, of the regulator's order against Clearview AI Inc. The order requires Clearview to stop collecting facial-recognition data on Quebec residents without consent and to destroy the resulting biometric identifiers. The court's rejection of Clearview's jurisdictional challenge - that Quebec's private-sector privacy framework and information-technology legal framework did not properly apply to its conduct - gives the regulator's order the weight of a confirmed judicial outcome rather than an unresolved administrative position. Against that active enforcement backdrop, it is notable that the regulator has held the power to impose administrative monetary penalties since September 2023, with ceilings set at the greater of $10 million Canadian dollars or two percent of worldwide turnover for less severe violations, rising to the greater of $25 million or four percent for serious or repeated violations. As at this period, no administrative monetary penalty has been published as having been issued under that power. The Clearview matter proceeded as an order-and-court-confirmation enforcement track rather than, on the evidence available this period, as a monetary-penalty track, and whether a monetary penalty forms part of that matter's resolution going forward was not confirmed this period. #### Outlook The Clearview confirmation strengthens the regulator's enforcement position generally and may encourage it to pursue similarly structured orders against other biometric or surveillance-technology operators with no Quebec establishment. Separately, the continued absence of any published administrative monetary penalty more than three years into the regulator holding that power remains a notable gap in the public enforcement record; whether the Clearview matter or a future case becomes the occasion for the first published penalty is the item most worth tracking in subsequent periods. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Cour du Quebec's 23 September 2026 decision confirming the Commission d'acces a l'information's order against Clearview AI Inc. is the principal enforcement-and-redress development in Quebec this window, and is described in contemporaneous legal-affairs commentary as an important and substantial decision. The case traces back to the CAI's original 2021 order, which Clearview appealed to the Cour du Quebec; the appellate confirmation closes out that appeal process with the order's substance intact, requiring Clearview to cease non-consensual facial-image collection and biometric-identifier creation in the course of carrying on an enterprise in Quebec, and to destroy images and identifiers already collected. The enforcement significance of the decision lies substantially in its confirmation of extraterritorial reach. The Court held that Quebec's privacy statutes apply to Clearview despite its lack of physical presence in the province, because its commercial activity -- scraping facial images to build a biometric database used in connection with services offered to Quebec-reachable clients -- brings it within the scope of the private-sector Act and the Act to establish a legal framework for information technology. In reaching this conclusion the Court also rejected Clearview's Charter-based challenge to the order, holding that the restriction on its freedom of expression is minimal and is justified in a free and democratic society given the order's beneficial effects for the public interest and for privacy protection. This is a two-part enforcement precedent: it confirms both that the CAI's original order was substantively sound and that it survives constitutional scrutiny on appeal. For redress purposes, the decision strengthens the practical force of CAI enforcement orders generally, since it demonstrates that such orders can be upheld on appeal against a well-resourced, out-of-jurisdiction respondent raising a constitutional defence. It is the first judicial-level confirmation of a CAI biometric-enforcement order within the observed window, giving the Commission's biometric-enforcement program an appellate precedent it did not previously hold on this specific point. #### Outlook Absent a further appeal by Clearview to a higher court, the Cour du Quebec's confirmation is likely to stand as the operative precedent for CAI enforcement against out-of-jurisdiction biometric-data collectors going forward, and may be expected to inform the CAI's approach to future enforcement matters involving similar fact patterns of non-consensual biometric data collection by entities without a Quebec physical presence. No further enforcement or redress development was identified within the observed window beyond this matter. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 72 words · 13 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties