Breach notification: Quebec

Privacy breach notification in Quebec.

2 notification duties in Quebec and 2 statutory harm tests, with who to tell, the timing the law sets, the threshold and the primary source for each. Last verified 2026-10-29.

Check your breach Assess the harm

At a glance

What applies in Quebec.

Quebec Law 25 (private sector) In force. private sector. Threshold: risk of serious injury. Commission d'accès à l'information du Québec (CAI): promptly (avec diligence).
Quebec Access Act (public sector) In force. public bodies. Threshold: risk of serious injury. Commission d'accès à l'information du Québec: promptly (avec diligence).

The rules

Every notification duty in Quebec.

Each row links the statute or regulator page it comes from and shows when it was last checked. Dataset version 2026-10-29.

Regime Applies to Notify Threshold Verified

Quebec Law 25 (private sector) Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8, and the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1) In force since 2022-09-22

Any enterprise (person carrying on an enterprise) that collects, holds, uses or communicates personal information in Quebec, including out-of-province organizations handling Quebec residents' data.

Commission d'accès à l'information du Québec (CAI): promptly (avec diligence) report
Persons concerned: promptly (avec diligence) report

Records: Keep a register of every confidentiality incident (including those without serious injury) with the eight prescribed categories; keep each entry up to date and retain it for at least five years after the enterprise became aware of the incident; provide a copy to the CAI on request (s. 3.8; Regulation ss. 7-8).

Penalties: Monetary administrative penalties of up to $50,000 for a natural person and, in all other cases, $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12); penal fines of $5,000 to $100,000 for a natural person and $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater, in all other cases (s. 91), doubled for a subsequent offence (s. 92.1).

risk of serious injury

Confidentiality-incident duties in force since September 22, 2022; the Regulation (O.C. 1761-2022) applied from late December 2022. Statutory wording is 'promptly' (EN) / 'avec diligence' (FR). Quebec financial institutions and credit assessment agents regulated by the AMF have a separate duty: the Regulation respecting the management and reporting of information security incidents by certain financial institutions and by credit assessment agents has been in force since April 23, 2025 and requires a report to the AMF via E-Services no later than 24 hours from the time an officer (or manager) is informed, with updates every three days.

2026-10-29

Quebec Access Act (public sector) Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11, and the Regulation respecting confidentiality incidents In force since 2022-09-22

Quebec public bodies: government departments, agencies, municipalities, school service centres, health and social services institutions, universities and colleges.

Commission d'accès à l'information du Québec: promptly (avec diligence) report
Persons concerned: promptly (avec diligence) report

Records: Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the CAI on request.

Penalties: Public bodies are subject to the Access Act's penal provisions. The monetary administrative penalties in s. 90.12 of the private sector Act apply to enterprises, not public bodies. Amounts are set in the Access Act.

risk of serious injury

Section numbering: the incident duties are ss. 63.8-63.11 (s. 63.7 is default confidentiality settings), not 63.7-63.10.

2026-10-29

Spotted an error or a change in the law? Report a correction with the source. The full dataset is rules.json (CC BY 4.0).

The harm test

When a breach in Quebec has to be reported.

The statutory wording, the factors the law names and the record you have to keep, from the harm thresholds dataset.

Quebec Law 25 (private sector)

Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, ss. 3.5 to 3.8

If the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'acces a l'information and any person whose personal information is concerned by the incident (s. 3.5).

Factors the law names

The sensitivity of the information concerned
The anticipated consequences of its use
The likelihood that the information will be used for injurious purposes
The person in charge of the protection of personal information must be consulted

Records: Keep a register of every confidentiality incident, whether or not the risk of injury is serious, recording the information involved, the circumstances, the date or period, the date the enterprise became aware, the number of persons concerned, the elements leading it to conclude whether there is a risk of serious injury, the dates of any notices and the measures taken after the incident; keep each entry up to date for at least five years after awareness and provide a copy to the Commission on request (s. 3.8; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1, ss. 7 and 8).

Verified 2026-10-29: Act respecting the protection of personal information in the private sector (Legis Quebec, EN) ; Regulation respecting confidentiality incidents, CQLR c. A-2.1, r. 3.1 (Legis Quebec) ; CAI: Prevenir les incidents de confidentialite, guide explicatif pour les entreprises (January 2026) ; CAI: Incidents de confidentialite et mesures de securite (entreprises)

Quebec Access Act (public bodies)

Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c. A-2.1, ss. 63.8 to 63.11

A public body that has cause to believe a confidentiality incident has occurred must take reasonable measures to reduce the risk of injury; if the incident presents a risk of serious injury, it must promptly notify the Commission d'acces a l'information and the persons concerned (s. 63.8).

Factors the law names

The sensitivity of the information concerned
The anticipated consequences of its use
The likelihood that the information will be used for injurious purposes
The person in charge of the protection of personal information must be consulted (s. 63.10)

Records: Register of all confidentiality incidents (s. 63.11), retained at least five years after awareness (Regulation s. 8); copy to the Commission on request.

Verified 2026-10-29: Loi sur l'acces (Legis Quebec, FR) ; Reglement sur les incidents de confidentialite

Work through the test for your breach

Federal law

Federal rules that can apply in Quebec too.

Federal duties follow the organization, not the province: a bank, a telecom or a private company in a province without its own private sector law reports under these as well.

PIPEDA Private-sector organizations that collect, use or disclose personal information in the course of commercial activity anywhere in Canada, federal works, undertakings and businesses (banks, telecoms, airlines, inter-provincial transport) and their employee data, and organizations in provinces without substantially similar private-sector law (every province except BC, Alberta and Quebec; health custodians in Ontario, NB, NS and NL are also substantially similar for health information).
Privacy Act / TBS Directive on Privacy Practices Federal government institutions subject to the Privacy Act (departments, agencies, Crown corporations listed in the schedule).
CCSPA (Bill C-8) Designated operators in federally regulated vital services and systems (telecommunications, interprovincial/international pipelines and power lines, nuclear, transportation, banking, clearing and settlement) once classes of operators are designated by regulation and listed in Schedule 2.
OSFI Incident Reporting Advisory Federally regulated financial institutions (banks, foreign bank branches, federal credit unions, life and P&C insurers, trust and loan companies). Administrators of federally regulated private pension plans have a separate OSFI advisory (2023) with the same 24-hour window, reported to pensions@osfi-bsif.gc.ca.
CIRO Rule 3703 CIRO investment dealer members. Mutual fund dealer members should confirm whether an equivalent reporting rule applies to them.
CSA continuous disclosure Reporting issuers (public companies) in Canadian jurisdictions.

Questions

Breach reporting in Quebec, answered from the rules.

Do I have to report a privacy breach in Quebec?

It depends on the kind of organization and the information involved. Quebec Law 25 (private sector) (in force, private sector): the threshold is risk of serious injury. Quebec Access Act (public sector) (in force, public bodies): the threshold is risk of serious injury. Federal rules such as PIPEDA can apply as well, depending on the organization.

How long do I have to report a breach in Quebec?

Quebec Law 25 (private sector): Commission d'accès à l'information du Québec (CAI), promptly (avec diligence). Quebec Access Act (public sector): Commission d'accès à l'information du Québec, promptly (avec diligence). Where a law sets a fixed number of hours or days, the breach notification tool shows a countdown.

Who has to be notified about a breach in Quebec?

Quebec Law 25 (private sector): Commission d'accès à l'information du Québec (CAI); Persons concerned. Quebec Access Act (public sector): Commission d'accès à l'information du Québec; Persons concerned. Conditional recipients apply only in the circumstances the law sets out; the rules table above gives the detail for each.

What harm test applies in Quebec?

Quebec Law 25 (private sector): If the incident presents a risk of serious injury, the person carrying on an enterprise must promptly notify the Commission d'acces a l'information and any person whose personal information is concerned by the incident (s. 3.5). Quebec Access Act (public bodies): A public body that has cause to believe a confidentiality incident has occurred must take reasonable measures to reduce the risk of injury; if the incident presents a risk of serious injury, it must promptly notify the Commission d'acces a l'information and the persons concerned (s. 63.8).

This page summarizes the law; it is not legal advice. Confirm the decision with counsel for anything you will act on.

Other jurisdictions