Quebec Law 25 for Real Estate and Proptech

01

What is Quebec Law 25?

Law 25 applies to any business that collects, uses, or discloses personal information about people in Quebec, regardless of where the business is located. That extraterritorial reach is the first thing many businesses outside Quebec miss. A US-based PropTech that has a Quebec-resident user is subject to Law 25 for that user's data. The law establishes higher consent standards than PIPEDA, mandatory breach notification, cross-border transfer rules, and administrative penalties enforceable by the Commission d'accès à l'information.

Key takeaway

Law 25 applies to any business processing personal information about Quebec residents, wherever the business is located.

02

How Law 25 differs from PIPEDA and GDPR

PIPEDA operates on implied consent for most standard business purposes; Law 25 requires explicit consent for sensitive collection and use. PIPEDA has voluntary breach notification for many scenarios; Law 25 mandates it within 72 hours for confidentiality incidents creating a risk of serious harm. Law 25 introduces a specific cross-border transfer rule requiring impact assessments before sending data outside Quebec. Businesses already GDPR-compliant will find the general obligations familiar; the specific mechanics (consent forms, French language requirements, Commission-approved contracts) still need Quebec-specific implementation.

Key takeaway

Law 25 sits between PIPEDA (weaker) and GDPR (broadly comparable). GDPR-compliant businesses have a head start but still need Quebec-specific implementation.

03

What Law 25 requires businesses to do

The obligations are extensive. Appoint a Privacy Officer whose name and contact are publicly listed. Publish a clear, French-first privacy policy. Obtain valid consent (specifically the consent standard depends on the sensitivity and purpose). Give individuals access to their data and the ability to correct or delete it. Notify the Commission and affected individuals of any confidentiality incident creating a risk of serious harm, within 72 hours. Conduct a Privacy Impact Assessment (PIA) before starting high-risk projects. Follow the cross-border transfer rules before sending data outside Quebec. Real estate businesses touch most of these obligations directly.

Key takeaway

Law 25 is not one obligation but a package: Privacy Officer, policy, consent, access, breach notification, PIAs, cross-border rules. Every one applies to real estate.

04

Consent and cookies under Law 25

The consent standard is materially higher than what most Canadian sites currently implement. Implied consent through continued site use is not sufficient for most non-essential tracking under Law 25. Practical implementation: a cookie banner that defaults to no non-essential tracking, categories the user can enable individually (functional, analytics, advertising), a persistent way to review and withdraw consent, and audit logs that record what each user consented to and when. Failing to implement this properly is one of the most common Law 25 compliance gaps at real estate sites operating in Quebec.

Key takeaway

Opt-in consent for non-essential tracking, with granular category controls and audit logs. Implied consent is not sufficient under Law 25.

05

Cross-border data transfers

This provision catches many businesses off guard because standard cloud infrastructure (AWS, Google Cloud, Azure) typically involves cross-border data flows even for Canadian operations. Practical implications: audit where each system stores and processes Quebec resident data, choose Canadian-region hosting where possible (AWS Canada Central, GCP Montreal, Azure Canada East), document the impact assessments, and use Commission-approved contractual clauses when transfers are necessary. Vendors should be evaluated on their Quebec compliance posture, not just their security posture.

Key takeaway

Every cloud vendor and third-party processor is a potential cross-border transfer. Audit, assess, and prefer Canadian-region hosting for Quebec resident data.

06

Confidentiality incidents and breach notification

A confidentiality incident is any unauthorised access, use, disclosure, or loss of personal information. The 72-hour clock starts when the business becomes aware, which in practice means having an incident response process that identifies and evaluates incidents quickly. The threshold for external notification is 'risk of serious harm,' which considers the sensitivity of the data, the ease of identification, and the probable use. All incidents must be logged in a register regardless of whether they meet the notification threshold, and the register can be requested by the Commission.

Key takeaway

72-hour notification for high-risk incidents; internal register for all incidents. Both require an incident-response process built and tested before an incident occurs.

07

Privacy impact assessments (PIAs)

For real estate businesses, this catches most technology projects: launching a new CRM, migrating from one PMS to another, deploying an AI tool that processes tenant data, integrating a new payment processor. The PIA process examines the necessity of the personal information, the proportionality of the collection, the security measures, the retention period, and the cross-border transfers involved. It is not just a form; it's a documented analysis that has to be defensible if the Commission asks.

Key takeaway

Any material technology change involving personal information triggers a PIA. Build the PIA process into your project intake, not just as a compliance afterthought.

08

Automated decision-making

This provision applies squarely to any AI or algorithmic tool that makes decisions about individuals without human involvement. Automated tenant screening, credit decisions, mortgage prequalification tools, and AI-driven lease approvals all fall under this requirement. Practical implication: any such system needs a disclosure to affected individuals, a way to explain the decision, and a human review path. Systems that operate as pure automated decisions without human oversight are non-compliant.

Key takeaway

Fully automated decisions about individuals require disclosure and a human review path. Build this into the workflow, not as an appeal process bolted on later.

09

Enforcement and penalties

The enforcement regime is aggressive by Canadian standards and comparable to GDPR by financial impact. The Commission has audit powers, can issue orders, impose administrative monetary penalties, and refer serious matters for criminal prosecution. Individuals can bring civil actions for damages. Real estate businesses should expect increased Commission activity as the regime matures, particularly in areas the Commission has flagged as priorities: consent, cross-border transfers, and automated decision-making.

Key takeaway

Penalties are material and enforcement is real. Treat Law 25 as an active compliance regime, not a paper exercise.

10

Practical implementation for real estate

The programme is a sustained effort, not a one-time fix. Start with the highest-risk gaps: consent and cross-border transfers are the most common enforcement targets. Update the privacy policy and appoint the Privacy Officer. Implement the cookie consent banner. Audit vendor contracts and add Commission-approved transfer clauses where needed. Build the incident response process before you need it. Train staff on the basics. Then loop back for continuous improvement. Businesses that treat Law 25 as an integrated programme rather than a checklist stay ahead of enforcement risk.

Key takeaway

Law 25 is a programme, not a checklist. Prioritise consent and cross-border transfers first, then work through the remaining workstreams over 6 to 12 months.