Scope of Application
Plain English Translation
Quebec Law 25 applies to any organization that collects, holds, uses, or communicates personal information in the course of carrying on an enterprise. This Loi 25 scope of application enterprises covers data stored in any format, whether physical or digital, and applies even if the data is managed by a third party. Organizations must clearly map their data flows to ensure alignment with Quebec privacy law requirements.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Identify all systems collecting or storing personal information.
- Draft a public privacy policy acknowledging Law 25 requirements.
Required Actions (scaleup)
- Map data flows including third-party processing to define the full scope of application.
- Implement centralized data inventory mapping to categorize data by format and purpose.
Required Actions (enterprise)
- Automate data discovery across all digital mediums and formats.
- Integrate scope assessments into standard enterprise architecture and procurement reviews.
Evidence Required
Quebec Law 25 applies to the collection, holding, use, or communication of personal information in the course of carrying on an enterprise. The Act respecting the protection of personal information in the private sector scope covers data in any format, whether kept directly or through a third person.
Any person or organization carrying on an enterprise that processes personal information must comply with Loi 25 compliance requirements. This includes businesses, associations, and partnerships operating within or targeting Quebec.
Yes, if an out-of-province company is carrying on an enterprise that involves collecting, holding, using, or communicating the personal information of individuals in Quebec, they must generally comply with Quebec privacy law requirements.
Carrying on an enterprise Quebec Law 25 definition refers to the carrying on of an economic activity, whether or not it is commercial in nature, organized and directed to the production or delivery of goods or services.
What personal information is covered under Law 25 includes any data that relates to a natural person and allows them to be identified. Law 25 applies regardless of format meaning it covers written, graphic, taped, filmed, computerized, and paper records.
Divisions II and III of the Act do not apply to personal information concerning the performance of duties within an enterprise, such as a person's name, title, duties, work address, work email, and work phone. However, other sensitive employee data falls under the Loi 25 scope of application enterprises.
Yes, does Law 25 apply to nonprofits and associations is answered in the affirmative if they carry on an enterprise. The Act also explicitly applies to personal information held by professional orders, political parties, independent Members, and independent candidates.
Yes, the Act explicitly states that it does not apply to journalistic, historical, or genealogical material collected, held, used, or communicated for the legitimate information of the public.
What data processing activities are in scope under Loi 25 includes the complete lifecycle of data. This covers initial collection, holding or storage, internal use, and Law 25 disclosure to third parties scope.
CISOs and compliance teams must map their data inventory to understand who does Quebec Law 25 apply to within their supply chain. They must evaluate all data collected, held, used, or communicated to ensure comprehensive adherence to Quebec privacy law requirements. Tools like WatchDog Security's Asset Inventory can help keep the system and SaaS inventory accurate, and WatchDog Security's Compliance Center can help link scope conclusions to evidence and periodic review workflows so the assessment stays current.
Scope tends to drift as teams add new SaaS tools, data stores, and processors, which can quietly expand where personal information is collected, held, used, or communicated. Tools like WatchDog Security's Asset Inventory can help maintain an up-to-date system and SaaS inventory, while WatchDog Security's Compliance Center can tie those assets to control ownership and evidence workflows so scope reviews stay aligned to real-world changes.
Third-party processing can create scope gaps when contracts, sub-processors, or data transfer paths are not consistently documented alongside internal data maps. Tools like WatchDog Security's Vendor Risk Management can help catalog vendors, track assessments and risk-tiering, and maintain processor details that support end-to-end data flow mapping and repeatable scope reassessments.
"The object of this Act is to establish, for the exercise of the rights conferred by articles 35 to 40 of the Civil Code concerning the protection of personal information, particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code. The Act applies to such information, whether the enterprise keeps the information itself or through the agency of a third person, whatever the nature of its medium and whatever the form in which it is accessible, whether written, graphic, taped, filmed, computerized, or other."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-23 | WatchDog Security GRC Team | Initial publication |
