Law 25 (Quebec)

Law 25 is the common name for Quebec's Act to modernize legislative provisions as regards the protection of personal information, which received royal assent on 22 September 2021 (it began life as Bill 64). It overhauled Quebec's private-sector privacy regime, layering in obligations modelled on Europe's GDPR. Its provisions came into force in three annual phases, with the bulk of new duties landing on 22 September 2023 and data portability following on 22 September 2024. It applies to virtually any business that collects personal information about Quebec residents, regardless of where that business is located.

Why it matters for sovereignty-minded operators

If you run a node service, a mining-pool dashboard, a hosted-hardware portal, or any tool that stores customer data, Law 25 likely reaches you. Core obligations include appointing a person responsible for privacy (a Data Protection Officer by default the most senior executive), running Privacy Impact Assessments before deploying systems that handle personal data or before transferring data outside Quebec, reporting confidentiality incidents (breaches) to the Commission d'accès à l'information and affected individuals, obtaining clearer consent, and honouring rights of access, correction, de-indexing, and portability.

How it applies in practice

Self-hosting your own infrastructure can simplify some Law 25 duties because you keep custody of the data and avoid third-party transfer assessments. Penalties are significant administrative monetary penalties and fines can reach into the millions or a percentage of worldwide turnover for serious violations which is why building privacy-by-default into your stack from day one matters more than retrofitting it later.

This is general information, not legal advice consult a qualified professional before making compliance decisions. For deeper context on running models and storing data locally to stay onside, see Quebec Law 25 and on-premise LLMs and our overview of Quebec data residency.