What is Law 25?

Quebec's overhaul of private-sector privacy law, in force in stages since 2022. It applies to any business that collects, uses, discloses or holds personal information in Quebec, with no employee or revenue threshold. It matters to automation because it covers consent, transparency, retention, communication of information outside Quebec, and decisions made by automated processing. It also requires you to have designated a privacy officer, which in a small business is usually the owner whether or not they know it.