Quebec Law 25 · enforcement
Law 25 Enforcement Tracker
I keep this tracker because enforcement is where privacy law gets real. Fines make headlines, but the day-to-day signal is quieter: the orders and decisions the Commission d’accès à l’information (CAI) publishes when Quebec organizations get personal information handling wrong. Every entry below is a real, published CAI action — orders, investigation findings, and monetary administrative penalties — each linked to its official source. I update it weekly.
5
Tracked actions
3
Orders
2
Decisions / findings
$0 CAD
SAPs imposed (0)
| Date | Respondent | Issue | Outcome / penalty | Source |
|---|
About this tracker
This tracker covers published CAI enforcement only: monetary administrative penalties (sanctions administratives pécuniaires, in force since September 2024) and published CAI orders and decisions against private-sector organizations. It does not cover access-to-information decisions involving public bodies, confidential investigations, or court proceedings.
A note on fines: as of the last update, the CAI has publicly announced enforcement mostly through orders and joint investigation findings — I have not found a publicly announced monetary administrative penalty under Law 25 yet. When the first one lands, it will appear here with its amount.
This tracker is not exhaustive and is not legal advice. It is a practitioner’s reading aid. For the definitive record, consult the CAI’s own publications.
Reading the fines? Check your own banner first.
Consent failures are a recurring theme in privacy enforcement. Run your site through the free cookie banner auditor and see how your opt-in consent holds up — before a regulator does.
Audit a cookie banner →