Canadian Privacy Laws: Law 25 and Canadian Consumer Privacy Protection Act (“CPPA”)

Law 25

Law 25 is a new law in Quebec that updates the privacy rules for businesses that handle personal information of Quebec residents. It was passed in September 2021 and will take effect gradually until 2024. 

Importantly, on September 22, 2023 businesses operating in Canada or collecting personal information from Quebec residents must provide enhanced consent and transparency protections to residents of Quebec before processing the personal data of a Quebec resident.


For example:

  • Organizations collecting personal information must publish pre-emptive or concurrent notices regarding the personal data proposed to be collected. 
  • Quebec residents must be given the opportunity to accept or reject the processing of their personal data.
  • The pre-emptive or concurrent notice of personal data collection must state:
    • The purposes for collection personal data
    • The methods or means of the personal data collection
    • The individual’s rights to access and rectification, and right to withdraw their consent
    • And, as applicable, the name or the categories of third parties to whom personal information might be disclosed as well as the possibility that their personal information may be transferred outside of Quebec. 


What is Canadian Consumer Privacy Protection Act (“CPPA”)

Canada’s CCPA is a proposed federal law in Canada that will update the privacy rules for the private sector. It is not yet known when it will become effective and enforceable, but some reports expect it to be by the end of 2023.

The CPPA is part of Bill C-27, also known as the Digital Charter Implementation Act, 2022, and will replace Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA), which is the current federal privacy law for the private sector.

The CPPA will impose new obligations and rights for organizations and individuals regarding the protection of personal information. It will also create a new Personal Information and Data Protection Tribunal that will have the power to impose penalties for non-compliance.

NextRoll will continue to stay on top of changes to data privacy laws around the globe and help its customers meet their compliance needs.


Was this article helpful?
0 out of 0 found this helpful

Articles in this section

Chat with an agent
Mon - Fri 10am - 6pm EST
Send a support email
Mon - Fri 10am - 6pm EST