Law 25 introduced requirements including designating a privacy officer, conducting privacy impact assessments in defined circumstances, obtaining express consent for sensitive information, and a right to data portability. It carries substantially higher maximum penalties than PIPEDA.
Why it matters: it applies based on handling the personal information of people in Quebec, so businesses located elsewhere in Canada can still be caught by it.