How Is Law 25 Enforced?

Regulatory Oversight by the CAI

The Commission d’accès à l’information du Québec (CAI) is the official regulator responsible for enforcing Law 25. The CAI has the authority to:

• Conduct audits and investigations
• Issue recommendations, compliance orders, and public warnings
• Impose financial and criminal penalties for violations

Its approach is both proactive and reactive — responding to complaints but also initiating audits at its discretion.

---

Penalty Framework

Law 25 introduces a tiered enforcement model with fines depending on the severity of the violation and the status of the offender (individual vs. organization):

Violation Level	Individuals	Organizations
Minor	$500 – $50,000	$1,000 – $10M or 2% of global revenue
Moderate	$1,500 – $50,000	$4,000 – $10M or 2%
Severe	$3,000 – $50,000	$8,000 – $10M or 2%
Very Severe	$5,000 – $50,000	$15,000 – $10M or 4% of global revenue

⚠️ Repeat offenses may result in doubled fines.

---

How Enforcement is Evaluated

When determining the outcome of an investigation, the CAI considers:

• The number of individuals affected
• The duration and frequency of the violation
• The sensitivity of the personal data involved
• The level of harm or risk to individuals
• Actions taken to remedy or mitigate the breach
• Cooperation with the Commission

---

Incident Management Requirements

All organizations must maintain a breach log and be prepared to respond to any incident involving personal information:

• Document all incidents — regardless of severity
• Notify the CAI and affected individuals without delay if there is a risk of serious harm
• Perform root cause analysis and document preventive actions taken

---

Need More Personalized Professional Help?

If you’d like tailored guidance or expert review of your Law 25 project, we’re here for you.

• ✅ Law 25 Readiness Assessment
• ✅ Free 30-minute Consultation with a Law 25 Specialist

📅 Schedule Your FREE Consultation NOW!