Law 25 Free Resources Center
Law 25 Readiness: Comparing Law 25, GDPR, and CCPA
Whether you’re starting your Law 25 project or enhancing existing compliance, STANDARD ONE provides essential templates, tools, and guides to empower your success — all at no cost.
Comparing Law 25, GDPR, and CCPA
Understanding the Landscape of Global Privacy Regulations
Quebec’s Law 25, the EU’s General Data Protection Regulation (GDPR), and California’s Consumer Privacy Act (CCPA/CPRA) all aim to protect personal data. But each takes a different approach. Here’s how they compare across core requirements:
| Feature | Law 25 (Quebec) | GDPR (EU) | CCPA/CPRA (California) |
|---|---|---|---|
| Effective Date | Sept 2022–2024 | May 25, 2018 | Jan 2020 (CCPA), Jan 2023 (CPRA) |
| Scope | Applies to orgs handling personal data of Quebec residents | Applies to any entity processing EU data, regardless of location | For-profit orgs doing business in CA with certain thresholds |
| Personal Data Definition | Broad: includes indirect identifiers, biometrics, etc. | Very broad: includes online IDs, health, location, etc. | Broad: includes household data, profiles, etc. |
| Legal Basis | Requires informed, specific, revocable consent | Must have lawful basis (consent, contract, legal duty) | Opt-out model; consent required for sensitive data |
| Consumer Rights | Access, correction, deletion, portability, limit automation | Access, correction, deletion, portability, objection | Access, deletion, correction, opt-out of sale/share |
| Automated Decisions | Must disclose and allow recourse | Right to not be subject to significant automated decisions | Limited coverage under CPRA |
| Cross-Border Transfers | Requires PIAs and assessment of destination protections | Requires safeguards or adequacy (e.g., SCCs) | No adequacy check; must disclose data sharing |
| Penalties | Up to $25M or 4% of global revenue | Up to €20M or 4% of global revenue | Up to $7,500 per intentional violation |
| Regulator | CAI (Commission d’accès à l’information) | Independent DPAs per member state | California Privacy Protection Agency (CPPA) |
Key Takeaways
- Law 25 brings Quebec in line with global privacy standards but adds local operational requirements.
- GDPR remains the most comprehensive framework globally, with strict obligations and broad scope.
- CCPA/CPRA gives consumers rights but emphasizes opt-outs and commercial transparency over prior consent.
Need More Personalized Professional Help?
If you’d like tailored guidance or expert review of your Law 25 project, we’re here for you.
- ✅ Law 25 Readiness Assessment
- ✅ Free 30-minute Consultation with a Law 25 Specialist
