What you'll learn
- Explain who Law 25 applies to and what it changed
- Describe the role of the person in charge of personal information
- Run a privacy impact assessment when the law requires one
- Manage confidentiality incidents and keep the incident register
- Obtain valid consent and respect individual rights, including portability
- Understand penalties and enforcement by the Commission d'accès à l'information
Course overview
Quebec's Law 25 modernised the province's private sector privacy law in three phases between 2022 and 2024. It applies to organisations that collect, use or share personal information about people in Quebec, wherever the organisation is based.
This online course walks through each obligation in practical terms: naming the person in charge of personal information, publishing governance policies, running privacy impact assessments, handling confidentiality incidents and keeping an incident register.
Later modules cover consent, transparency, automated decisions, transfers outside Quebec and the rights individuals can exercise, including data portability.
The course also explains enforcement, including administrative monetary penalties and fines that can reach up to $25 million or 4% of worldwide turnover for the most serious offences.
Course curriculum
Module 1: Law 25 at a glance
- Who it applies to
- The three phases
- The Commission d'accès à l'information
Module 2: Governance
- The person in charge of personal information
- Policies and practices
- Privacy impact assessments
Module 3: Confidentiality incidents
- What counts as an incident
- Notification
- The incident register
Module 4: Consent and rights
- Valid consent
- Transparency and automated decisions
- Access, correction and portability
Module 5: Transfers and enforcement
- Transfers outside Quebec
- Penalties and fines
- Final assessment
Who is this course for?
- Organisations that collect personal information about people in Quebec
- Privacy officers and compliance teams
- HR, marketing and IT staff who handle personal information
- Business owners outside Quebec with Quebec customers
Prerequisites
No prior experience required. Lessons start from the basics and build towards practical application.
Assessment
Short quizzes throughout the course. Pass mark: 70%, with up to 3 attempts.
A Certificate of Completion from Charter Compliance Academy
Complete all lessons and score 70% or more in the final assessment, and your Certificate of Completion is issued instantly in your account. Issued by Charter Compliance Academy, it shows your name, the course title, the issue date and a unique certificate ID, as an A4 page you can print or save as PDF. Use it for your learning records and HR files, or share it with your employer or on LinkedIn. It records that you completed this on-demand online course; it is not a professional licence, designation or accreditation.
All course content is written and owned by Charter Compliance Academy, an independent provider of on-demand online courses. We are not affiliated with or endorsed by FINTRAC, the Office of the Privacy Commissioner of Canada, any provincial ministry of labour, the WSIB, CCOHS or any other government body or standards organisation.
- 1Complete the lessons
- 2Pass the final (70%+)
- 3Get your Certificate of Completion
Frequently asked questions
Does Law 25 apply to businesses outside Quebec?
It can. If your organisation collects personal information about people in Quebec, Law 25 may apply even if you are based elsewhere.
Is the course available in French?
The course is in English for now.
Is this legal advice?
No. It explains the law in plain English. Speak with a lawyer about your specific situation.
Who should take it?
Privacy officers first, then staff in HR, marketing, IT and customer service who handle personal information.
Enrolling a team?
We offer company pricing with progress tracking for your staff and a Certificate of Completion for every learner.
