What Data and Rights Does Law 25 Cover?

Defining Personal Information

Law 25 defines personal information as any data that can identify an individual, directly or indirectly. This includes:

• Full names
• Email addresses
• Phone numbers
• IP addresses and geolocation data
• Identification numbers
• Financial and health records
• Biometric and behavioral data

Even pseudonymized or aggregated data may fall under Law 25 if it can reasonably lead to re-identification.

---

Key Consumer Rights Under Law 25

Law 25 grants Quebec residents several rights concerning their personal data:

• Right to Access: Request to see what personal data is collected and how it’s used.
• Right to Rectification: Ask for incorrect or outdated data to be corrected.
• Right to Deletion (Right to Be Forgotten): Request deletion of data when no longer needed.
• Right to Data Portability: Obtain a structured, machine-readable copy of personal data (effective September 2024).
• Right to Withdraw Consent: Opt out at any time from data use based on consent.
• Right to Contest Automated Decisions: Be informed of algorithmic decisions and seek human review.

---

Consent Requirements

Under Law 25, consent must be:

• Free: Given voluntarily without coercion
• Informed: Clear on what is being collected and why
• Specific: Granted for each distinct purpose
• Unambiguous: No pre-checked boxes or vague language

Consent must be obtained from a parent or guardian for minors under 14.

---

Sensitive Personal Data

Certain types of data require express consent under Law 25, including:

• Health-related data
• Biometric identifiers
• Government-issued IDs
• Data about minors

---

Need More Personalized Professional Help?

If you’d like tailored guidance or expert review of your Law 25 project, we’re here for you.

• ✅ Law 25 Readiness Assessment
• ✅ Free 30-minute Consultation with a Law 25 Specialist

📅 Schedule Your FREE Consultation NOW!