Skip to content
Menu ▾
Patent pending

Regulayer  /  The 146 laws  /  Privacy law

Quebec · Law 25 (P-39.1)

Private-sector personal-information protection.

Applies to: Enterprises handling personal data in Quebec. Built · in force 2022-2024

What the signed record shows

Confidentiality-incident register entries, automated-decision and consent records.

The proof is a signed, tamper-evident record. Anyone can check it, free, without an account, and nothing has to leave the building to make it. Evidence, not a promise.

Citation: CQLR c. P-39.1 ss. 3.5/3.7/3.8/12.1 (S.Q. 2021, c. 25)

In the same family

What to do about it

Seven days free, then $349 a month.

A signed record of which AI you used and what you checked, sealed to the exact file you deliver, made on your own machine and checkable free by anyone you send it to.

Start the free weekOr verify a real record, free →

Part of the Regulayer proof catalogue: 146 laws and standards, one sealed engine. This page is a product description, not legal advice.

What the statute requires, section by section

An Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64), S.Q. 2021, c. 25, amending the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1). Provisions addressed:

P-39.1 s. 3.5
Confidentiality incident: obligation to take measures and to notify the Commission d'accès à l'information (CAI) and affected persons where there is a risk of serious injury.
P-39.1 s. 3.7
Risk-of-injury assessment factors (sensitivity, consequences, likelihood of injurious use).
P-39.1 s. 3.8
Register of confidentiality incidents (mandatory; retained at least 5 years; a copy is provided to the CAI on request).
P-39.1 s. 12.1
Automated decision-making: inform the individual and, on request, provide the information used and the principal factors. Phased in force: 22 Sept 2022 / 2023 / 2024.

Taken from the Regulayer entry for this instrument, which is built against the primary text.

Quebec’s judiciary has also written down what it expects of AI

On 31 August 2026 the Chief Justices of Quebec signed Lignes directrices sur l’utilisation de l’intelligence artificielle générative par les juges, announced on 4 September 2026 and signed by Geneviève Cotnam, Marie-Anne Paquette, Henri Richard and Nathalie Duchesne. They are recommendations, not a practice direction, and the self-assessment annex is expressly of no normative value. They govern judges, not advocates, and they sit alongside Law 25 rather than inside it.

Three provisions are worth reading even if you never appear in Quebec. The core rule: no judge may delegate the decision-making function to a generative AI system, because «Juger est un acte exclusivement humain», judging is an exclusively human act. On responsibility: the judge remains responsible for the accuracy of references, citations and authorities, and «Aucune erreur ne peut être imputée à l’outil utilisé», no error can be attributed to the tool used. And section 6 requires that documents supplied by the parties or by third parties are not passed to a tool without prior checking of their content, provenance and format, because they may contain hidden information or instructions capable of unduly influencing the tool or compromising its reliability. That is the first judicial instrument in this record to name hidden-instruction attacks.

The self-assessment annex asks the judge to confirm, among other boxes, «j’ai conservé une trace de ma démarche préalable», that a record of the prior process has been kept.

Working translations, made from the French text read at source on 11 September 2026. No official English version exists. The guidelines, ten pages · the evidence duties timeline