"Twenty-five million dollars." That number shows up in every Law 25 presentation, usually to scare the room. For the owner of a West Island staffing agency holding 3,000 résumés, the real questions are different: what actually triggers a penalty, and what would it really cost?
The answers are in two official documents: the Act itself and the general enforcement framework that Québec's privacy regulator, the Commission d'accès à l'information (CAI), published on May 11, 2023. This guide walks through both, section by section, for businesses in Québec and for those elsewhere in Canada that serve Quebecers.
TL;DR
- Two regimes: administrative monetary penalties (AMPs) imposed by the CAI, up to $10M or 2% of worldwide turnover, and penal fines from $15,000 to $25M or 4%.
- The CAI's framework sorts failures into four categories, with a base amount of $1,000 to $15,000 for a business, then adjusted for the circumstances.
- No AMP without a prior notice of non-compliance and a chance to respond.
- Individuals can also be awarded punitive damages of at least $1,000 (s. 93.1).
What are the maximum fines under Law 25?
A business faces at most an administrative penalty of $10 million or 2% of worldwide turnover, and a penal fine of $25 million or 4%, whichever is greater in each case. Those ceilings are set by sections 90.12 and 91 of the Act respecting the protection of personal information in the private sector. According to the CAI, its power to impose AMPs has applied since September 22, 2023. (The Act's English text calls them "monetary administrative penalties.")
| Administrative monetary penalty | Penal fine | Punitive damages | |
|---|---|---|---|
| Who decides | A person designated by the CAI (s. 90.1) | A judge, in proceedings brought by the CAI (s. 92) | A civil court (s. 93.1) |
| Business | Up to $10M or 2% of worldwide turnover | $15,000 to $25M or 4% of worldwide turnover | At least $1,000 |
| Natural person | Up to $50,000 | $5,000 to $100,000 | At least $1,000 |
| Repeat breaches | Aggravating factor (CAI framework) | Fines doubled (s. 92.1) | Not applicable |
| Time limit | 2 years after the failure (s. 90.10) | 5 years after the offence (s. 92.2) | Civil law rules |
Which failures can lead to an administrative penalty?
Section 90.1 lists six failures that can lead to an AMP, and four of them directly concern a typical small or mid-sized business:
- failing to inform people when collecting their information (ss. 7 and 8);
- collecting, using, communicating, keeping or destroying information in contravention of the law;
- failing to report a confidentiality incident to the CAI or to the people concerned, where required;
- failing to take the security measures required by section 10.
The other two concern decisions based exclusively on automated processing (s. 12.1) and personal information agents.
The fourth item links your cybersecurity directly to penalty risk. What the Act targets is not having been attacked, but failing to take the security measures "necessary to ensure the protection" of the information, reasonable given its sensitivity, quantity and medium.
The penal side (s. 91) repeats several of these failures and adds others: impeding a CAI inquiry, ignoring a formal demand for documents, retaliating against someone who filed a complaint, or failing to comply with an order.
How the CAI calculates a penalty
According to the general framework the CAI published on May 11, 2023, an AMP is set in two steps: a severity category determines a base amount, then aggravating or mitigating factors adjust it.
| Category | Description in the CAI framework | Base amount, business | Base amount, natural person |
|---|---|---|---|
| A | Minor failure, usually administrative, with no or minor consequences | $1,000 | $500 |
| B | Moderate failure, moderate consequences | $4,000 | $1,500 |
| C | Serious failure, major consequences | $8,000 | $3,000 |
| D | Very serious failure, major, actual and/or irreparable consequences | $15,000 | $5,000 |
The base amount is then raised or lowered based on factors such as the duration and repetition of the failure, the sensitivity of the information, the number of people affected, the risk of serious injury, the steps taken to fix the problem, cooperation with the CAI, compensation offered to those affected and ability to pay. The result can go up to the statutory maximum.
Two safeguards frame the regime. First, no AMP can be imposed without a prior notice of non-compliance and an opportunity to submit observations (ss. 90.3 and 90.4). Second, you can at any time give the CAI an undertaking to remedy the failure: if the CAI accepts it and you honour it, no AMP can be imposed for the acts or omissions it covers (s. 90.1).
When the CAI prefers penal proceedings
The CAI generally prioritizes penal proceedings for serious cases: a significant invasion of privacy, a vulnerable clientele, sensitive information, failure to comply with an order, or intentional, negligent or reckless conduct. That is what its general framework says, adding obstruction of an inquiry, failure to correct despite earlier AMPs, and repeated breaches.
In penal cases, a judge sets the fine. The judge considers, among other things, whether the offence was foreseeable, any attempt to conceal it, and whether the offender increased revenue or reduced expenses by failing to take preventive measures (s. 92.3). In other words, "saving money" on security can make the sentence heavier. Any director or officer who authorized the offence, or consented to it, is a party to it (s. 93).
Inquiries and orders: the CAI's other powers
Penalties are only one tool: the CAI can also investigate, demand documents and order corrective measures. It can:
- open an inquiry on its own initiative or following a complaint, which can be anonymous (s. 81);
- issue a formal demand for any document needed to verify compliance (s. 81.3);
- when an incident is brought to its attention, order any measure to protect people's rights, including the return or destruction of the information (s. 81.4);
- after an inquiry, recommend or order corrective measures (s. 83), then publish a notice if the business does not comply (s. 84).
Those orders have teeth, including outside Québec. In December 2021, the CAI ordered Clearview AI to stop collecting Quebecers' personal information and to destroy their images and biometric identifiers. According to a CAI announcement dated October 16, 2026, the Court of Québec upheld the order and found a real and substantial connection between the U.S. company and Québec, despite the company's argument that it had had no office, employee or client there since July 2020. If your business is based in Ontario or elsewhere but serves Québec customers, ask your counsel how that reasoning applies to you.
How to reduce your exposure
Your best defence is a file that documents your efforts, since the CAI weighs the steps you took, your cooperation and any compensation offered. For a business holding thousands of customer records, the civil risk of punitive damages comes on top of the regulatory one.
- Document your security measures: MFA, patching, tested backups (s. 10).
- Keep your incident register up to date, minor incidents included (s. 3.8).
- Report incidents that present a risk of serious injury promptly (our guide to reporting to the CAI).
- Respond quickly to a notice of non-compliance, with a dated remediation plan.
- Never give the CAI inaccurate or incomplete information: obstruction is a separate offence (s. 91).
- Keep a written record of management decisions.
For an overview of the controls to put in place, see our Law 25 cybersecurity checklist and, for your website, our guide to Law 25 and cookies.
This article summarizes the Act and the CAI's framework; it is not legal advice. Validate your situation with your legal counsel. To find out where your biggest risks are, book a free consultation or explore our Law 25 compliance support.
Frequently asked questions
What is the maximum fine under Quebec Law 25?+
An administrative monetary penalty can reach $10 million or 2% of worldwide turnover for the preceding fiscal year, whichever is greater (s. 90.12). Penal fines range from $15,000 to $25 million or 4% of worldwide turnover (s. 91), and they double for a subsequent offence (s. 92.1). The ceilings are the same for a small business, but ability to pay is one of the CAI's criteria.
Can directors or officers be held personally liable under Law 25?+
Yes. When a legal person commits an offence, any director, officer or representative who ordered or authorized it, or consented to it, is a party to the offence and liable to the prescribed penalty (s. 93). For a natural person, penal fines range from $5,000 to $100,000, and administrative penalties can reach $50,000.
How long does the CAI have to penalize a business?+
The CAI has two years from the date of the failure to impose an administrative monetary penalty (s. 90.10), and five years from the offence to institute penal proceedings (s. 92.2).
Can a business contest a Law 25 administrative penalty?+
Yes. You can apply in writing for a review of the decision within 30 days of being notified of the notice of claim (s. 90.6). The review decision can then be contested before the Court of Québec within 30 days of its notification (s. 90.9).
Sources
- 1.Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 81 to 93.1
- 2.CAI — General framework for the application of monetary administrative penalties (French, May 11, 2023)
- 3.CAI — Penalties for private businesses (French)
- 4.CAI — Monetary administrative penalties (news item, French)
- 5.CAI — Clearview AI: Commission order upheld by the Court of Québec (French, October 16, 2026)