Quebec Law 25 (Loi 25) Compliance for MSPs: A Practical Guide for 2026

TLDR: Quebec Law 25 (Loi 25) is fully in force and applies to any private-sector enterprise that handles personal information of people in Quebec — no revenue or headcount threshold. For MSPs, that means Quebec clients need a designated privacy officer, documented privacy impact assessments (EFVPs), a confidentiality incident register, granular consent, and written agreements with service providers. Penalties reach $10 million CAD or 2% of worldwide turnover (administrative) and $25 million or 4% (penal). This guide covers the obligations MSPs can deliver as a recurring service and how to package it alongside PIPEDA.

Quebec modernized its private-sector privacy law in 2021 with Law 25 (formally An Act to modernize legislative provisions as regards the protection of personal information). The requirements phased in on September 22 of 2022, 2023, and 2024. By late 2026 every obligation is active. There is no small-business exemption. A four-person firm in Trois-Rivières faces the same baseline rules as a larger enterprise (OKTO Solutions).

MSPs that serve Quebec clients, or U.S. and Canadian clients that process personal information of Quebec residents, sit in the middle of that obligation. The client is the enterprise carrying on business. The MSP is typically a service provider that holds or processes personal information on the client's behalf. Both sides have work.

What Law 25 Actually Requires

The core obligations that show up in almost every engagement are straightforward once you map them to operational work.

Privacy officer. Every enterprise must designate a person responsible for the protection of personal information. By default this is the highest-ranking person in the organization. The designation can be delegated in writing. The title and contact information must be published on the organization's website. This has been required since September 2022 ([CAI overview of Law 25 changes](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25)).

Privacy impact assessments (EFVP / PIA). Before acquiring, developing, or overhauling an information system or electronic service that involves personal information, the enterprise must complete a privacy impact assessment. The same requirement applies before communicating personal information outside Quebec. The assessment evaluates whether the receiving jurisdiction provides adequate protection and must be documented ([CAI on transfers outside Quebec](https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25)).

Confidentiality incident register and notification. Organizations must keep a register of confidentiality incidents. Incidents that present a risk of serious injury must be reported to the Commission d'accès à l'information (CAI) and the affected individuals. The register is retained for five years.

Consent and transparency. Consent must be clear, free, informed, and given for specific purposes. Sensitive information (medical, financial, biometric, etc.) generally requires express consent. Automated decision-making that has a significant effect on the individual requires transparency.

Data portability. Since September 22, 2024, individuals can request their computerized personal information in a structured, commonly used technological format. The organization has 30 days to respond.

Vendor agreements. Written agreements are required with any service provider that processes personal information on the enterprise's behalf. The agreement must describe the information, the purposes, the security measures, breach-notification duties, and destruction or return requirements.

Administrative monetary penalties imposed by the CAI can reach $10 million CAD or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines can reach $25 million CAD or 4% of worldwide turnover (Act respecting the protection of personal information in the private sector, ss. 90.12 and 91). Individuals may also pursue civil damages, including punitive damages of at least $1,000 in certain cases.

Where the MSP Fits

Most MSPs are not the "enterprise carrying on business in Quebec" for their clients' customer data. They are service providers. That still creates concrete obligations:

• You need a written agreement that satisfies Law 25's service-provider clauses.
• If you transfer client personal information outside Quebec (common with U.S.-hosted tools, backups, or ticketing systems), the client must have completed the required assessment. You should be able to support that assessment with security documentation.
• You may handle confidentiality incidents that affect Quebec personal information and therefore need a process that feeds the client's register and CAI notification decision.
• If you collect personal information of Quebec residents in your own right (marketing lists, employee data for a Quebec office, etc.), you become the enterprise for that data and need your own privacy officer, policies, and assessments.

For pure multi-tenant MSP work the practical model is: the client owns the privacy program; you deliver the technical and documentary evidence that makes the program real.

Controls MSPs Actually Deliver

Map the legal requirements to the work you already do.

Identity and access. MFA, conditional access, least-privilege roles, and timely offboarding support the "safeguards" expectation and reduce the chance of a confidentiality incident. Document the configuration so it can appear in an EFVP or vendor assessment.

Vendor and SaaS inventory. Maintain a current list of systems that touch client personal information, note where the data resides, and keep the service-provider agreements. When a new tool is introduced, flag whether an EFVP is required before the data moves.

Incident response. Your existing ticket and escalation process becomes the confidentiality-incident workflow. Record the facts, the risk-of-serious-injury determination, the CAI notification decision, and the communications. Retain the record for five years.

Policies and training. A short, plain-language privacy policy, a published privacy-officer contact, and staff training on handling personal information close the most common baseline gaps. For Quebec-facing clients the policy should be available in French.

Evidence collection. Screenshots of MFA enforcement, access reviews, backup test results, and the incident register are the artifacts the client will need for a CAI inquiry, a cyber-insurance renewal, or a customer security questionnaire. Build them into the monthly or quarterly cadence so they exist before anyone asks.

These controls overlap heavily with the technical baseline you already run for HIPAA, SOC 2, or CIS Controls. The difference is the Quebec-specific documentation: the privacy officer designation, the EFVP for cross-border transfers, and the CAI-facing incident process.

Packaging Law 25 as a Recurring Service

Do not sell Law 25 as a one-time project. Sell a program that produces evidence.

Initial engagement. Designate and publish the privacy officer (or confirm the client's existing designation). Inventory personal information and data flows, especially anything leaving Quebec. Complete or update the required EFVPs for major systems and transfers. Execute or refresh service-provider agreements. Stand up the confidentiality-incident register and notification procedure. Publish or refresh the privacy policy.

Monthly retainer. Monitor access and MFA, track new SaaS tools that require an EFVP, log and triage potential incidents, and produce a short compliance summary for the client.

Annual cycle. Refresh the data inventory and EFVPs, test the incident process (tabletop), confirm training completion, and deliver a white-label readiness report the client can share with insurers or larger customers.

Price the initial project for a typical small-to-mid Quebec client in the mid-to-high four figures, then a monthly retainer that sits on top of existing managed services. Clients that process sensitive data (health, financial, employee) or that move data outside Canada warrant higher scope. See MSP compliance services and pricing for packaging patterns that already work across the other frameworks.

The same multi-tenant dashboard that maps controls across HIPAA, SOC 2, and the other nine frameworks can hold the Law 25 evidence. One assessment covers every framework the client falls under, including Loi 25.

How Law 25 Intersects with Cyber Insurance and Other Frameworks

Canadian and cross-border cyber-insurance applications increasingly ask about privacy-program maturity, incident-response testing, and vendor controls. A documented privacy officer, current EFVPs, and an incident register are concrete answers to those questions. The same evidence supports the MSP cyber insurance approval checklist.

Law 25 also sits beside PIPEDA for clients that operate across Canada. The federal law and the Quebec law share themes (consent, safeguards, breach notification) but the Quebec regime is stricter on assessments, portability, and penalty ceilings. Many MSPs package a base Canadian privacy service and add a Loi 25 tier for Quebec-resident data. See the PIPEDA compliance guide for MSPs for the federal side.

For clients that also need SOC 2 or a security questionnaire response, the same control evidence reduces duplication. The SOC 2 compliance checklist for MSPs shows how to turn technical work into auditor-ready artifacts; the Law 25 work is the privacy-specific overlay.

Start with Two Quebec Clients

Law 25 is practical MSP work: a named privacy officer, documented assessments for data leaving Quebec, a living incident register, and written vendor agreements. The clients that need it most are small and mid-size Quebec businesses that will never hire a full-time privacy officer.

Nuronus maps assessed controls across all 11 frameworks — including Loi 25 — from a multi-tenant dashboard, with white-label reports and evidence tracking you can deliver under your brand. The platform and the Canadian frameworks are available in Canadian French. Start free with up to 2 clients — no credit card required — and put your two highest-exposure Quebec accounts on a real compliance cadence before you scale the practice.