LexLint

Know the law your code answers to.

Law / Canada / Quebec

Act respecting the protection of personal information in the private sector, comprehensive regime

CQLR c P-39.1, ss. 3.1-3.4, 8.1, 12-14

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 22 September 2023.

A comprehensive regime rule binding private bodies.

As of 24 September 2026.

What it requires

  • Designate a person in charge of the protection of personal information, by default your enterprise's highest-ranking officer, and publish that person's title and contact information on your website.
  • Establish and implement governance policies and practices for personal information, including a framework for retention and destruction, and conduct a privacy impact assessment before acquiring, developing or overhauling a system or service that collects, uses, communicates, keeps or destroys personal information.
  • Obtain clear, free and informed consent requested for each specific purpose before using or communicating personal information for a purpose other than the one for which it was collected, and obtain express consent where the information is sensitive.
  • Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Any person carrying on an enterprise in Québec must designate a person in charge of the protection of personal information, by default the enterprise's own highest-ranking officer, and publish that person's title and contact information.

The enterprise must establish and implement governance policies and practices for personal information, covering retention and destruction, and must conduct a privacy impact assessment before acquiring, developing or overhauling an information system or electronic service delivery system that collects, uses, communicates, keeps or destroys personal information.

Consent to use or communicate personal information for a new purpose must be clear, free, informed, requested for each specific purpose and given expressly where the information is sensitive. A person who collects personal information using technology that can identify, locate or profile the individual must first disclose the use of that technology and how to activate its identifying, locating or profiling functions.

The duty to designate a person in charge took effect a year earlier than the rest of this row, on September 22, 2022; the governance-policy, privacy impact assessment, technology-notice and consent duties took effect September 22, 2023. The consent and use rules of this row do not reach personal information that is public by law.

When LexLint raises it

  • crawls_web
  • trains_models
  • generates_content
  • deploys_chatbot
  • automated_outreach
  • processes_voice
  • processes_biometrics
  • operates_social_platform
  • serves_minors
  • operates_app_store
  • ships_mobile_app
  • aggregates_content

Read the law

official consolidated statute text, LégisQuébec (Éditeur officiel du Québec)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app