Quebec Law 25: What Dealerships Operating in Quebec Must Do
Quebec has modernized its private-sector privacy law through Law 25 (formerly Bill 64), and it is now one of the strictest privacy regimes in Canada. If your dealership operates in Quebec, or simply handles the personal information of Quebec residents, these rules apply to you regardless of where your head office sits. Dealers who assumed federal PIPEDA compliance was enough have discovered real gaps.
Why Law 25 Is Different
Law 25 goes well beyond PIPEDA in several respects. It introduces mandatory internal roles, tighter and more granular consent standards, formal breach obligations, and significant penalties for non-compliance. The reforms rolled out in stages over several years, giving businesses time to prepare — but that also means the expectations on you are now fully in force, not aspirational.
Key Obligations for Dealers
The practical requirements that most affect a Quebec dealership include a set of concrete steps you can assign and track:
Designating a person responsible for the protection of personal information — a privacy officer
Reporting confidentiality incidents that pose a risk of serious injury to the regulator and to affected individuals
Conducting privacy impact assessments for certain projects and new technology acquisitions
Obtaining clear, granular consent, with heightened care for sensitive information
Publishing plain-language privacy policies that people can actually understand
New Rights for Customers
Law 25 grants Quebec residents rights that dealers must be ready to honour, including data portability — the right to receive their information in a structured, commonly used technological format — along with stronger rights to correction and to de-indexing. The portability right is a practical challenge: your systems need to be able to export a customer's data in a usable format, not merely display it on a screen for staff.
The Penalties Are Serious
Law 25 carries administrative monetary penalties and separate penal provisions that, for the most serious violations, can reach into the tens of millions of dollars or a percentage of worldwide turnover. Even setting the worst-case figures aside, the reputational damage of a publicized privacy failure in a tight-knit local Quebec market can cost far more than any fine in lost trust and referrals.
Getting Ready
Start by formally naming your privacy officer, mapping exactly where Quebec customer data lives across your systems, and confirming you can detect, log, and report an incident quickly and to the right people. Then automate consent capture and data export so these obligations do not depend on someone improvising under stress in the middle of an incident. Many dealers find that the discipline Law 25 demands ends up improving their operation everywhere else too — cleaner data, clearer policies, and fewer surprises. Treat it as an upgrade to how you handle customer information rather than a box-ticking burden, and the compliance largely takes care of itself.
This is general information and not legal advice; engage Quebec-qualified counsel for Law 25 compliance.
Dabadu TrustShield supports Law 25 readiness with centralized data, incident logging, and structured data export to satisfy portability requests.
Prepare for Quebec's Law 25 with Dabadu TrustShield, which centralizes data, logs incidents, and enables the structured exports the law now requires.
