Quebec's privacy law is stricter than PIPEDA. Vimy covers both.
Law 25 modernized Quebec's privacy framework with mandatory breach reporting, privacy impact assessments, data governance requirements, and transparency obligations. Vimy maps all key obligations and auto-collects evidence from your security operations.
If you operate in Quebec, Law 25 applies to you.
Quebec's Act Respecting the Protection of Personal Information in the Private Sector — commonly called Law 25 — was fully enacted on September 22, 2024. It applies to any organization that collects, holds, uses, or discloses personal information of Quebec residents, regardless of where the organization is headquartered.
Law 25 goes further than PIPEDA in several critical areas: mandatory privacy impact assessments, data inventory requirements, a designated privacy officer, and administrative monetary penalties up to $25 million or 4% of worldwide turnover — whichever is greater.
This isn't a future concern. It's fully in force today.
Law 25 rollout
What Law 25 requires — and how Vimy helps.
Eight of Law 25's core obligations — and how Vimy evidences compliance with each one from live security operations.
Where Law 25 goes further than PIPEDA.
PIPEDA compliance is a foundation — not a ceiling. For organizations operating in Quebec, Law 25 adds requirements that PIPEDA simply doesn't cover.
| Requirement | PIPEDA | Law 25 |
|---|---|---|
| Breach reporting | To OPC — risk of significant harm | To CAI — risk of serious injury, with diligence |
| Privacy impact assessments | Not mandated | Mandatory for new projects & system changes |
| Privacy officer | Recommended, not required | Mandatory, with public contact information |
| Data inventory | Not explicitly required | Mandatory — categories, purposes, retention |
| Penalties | Up to $100K per violation | Up to $25M or 4% worldwide turnover |
| Data portability | Not required | Required — structured, portable format |
| Automated decision transparency | Not required | Required — individuals must be informed |
| Consent requirements | Implied consent accepted in some cases | Explicit, clear, informed consent required |
Vimy maps both PIPEDA and Law 25 simultaneously. Organizations operating across Canada and Quebec evidence both from the same security data — no duplicate work.
Law 25 has real teeth.
force
The CAI can investigate complaints, conduct audits, and impose penalties without prior warning. Having evidence of reasonable safeguards isn't optional — it's your primary defense.
Law 25 + PIPEDA + SOC 2. One platform.
Quebec businesses often face a triple compliance challenge: Law 25 provincially, PIPEDA federally, and SOC 2 or ISO 27001 from enterprise customers. Three frameworks, significant overlap, and traditionally three separate compliance efforts.
Vimy maps all of them from the same security data. A single incident response action satisfies Law 25 breach reporting, PIPEDA breach records, and SOC 2 incident response controls — simultaneously.
PIPEDA
Federal privacy law — 10 fair information principles. PIPEDA evidence is included in all plans, including Sentinel. Law 25 and PIPEDA overlap significantly.
See PIPEDA coverage →SOC 2 Type II
Privacy is a Trust Services Criterion. Law 25 evidence feeds directly into SOC 2 privacy controls — one security action, two frameworks evidenced.
See SOC 2 coverage →ISO 27001
Annex A covers data protection and information security. Law 25 safeguards map directly to ISMS requirements — compliance from one evidence stream.
See ISO 27001 coverage →Law 25 compliance features are available on Bastion and Citadel plans.
PIPEDA evidence — which covers overlapping requirements — is included in all plans, including Sentinel.
See Plans →Common questions about Law 25 with Vimy.
Get ahead of
Law 25 enforcement.
30-minute demo. We'll show you where your Law 25 obligations are covered and where the gaps are.