How Quebec's Law 25 changes consent and data rules for PR campaigns

What to take away

• Quebec Law 25 PR campaigns must meet stricter consent, retention and breach notification rules than PIPEDA alone requires.
• Consent must be clear, specific and separate from other terms, and it must be easy to withdraw.
• The Commission d'accès à l'information du Québec enforces the law and receives breach reports.
• A privacy officer must be designated, and retention schedules must be documented.
• Breach notification has a prompt timeline and can include notifying affected people.
• Vendors and agencies that touch Quebec data are covered by the same duties.

What Law 25 changes for consent in Quebec PR campaigns

Law 25 rewrote consent rules for anyone collecting personal information in Quebec. It applies to a PR campaign that builds a media list, runs an email drip or scans badges at a Montreal event. The law sets a higher bar than what many Canadian teams apply outside Quebec.

Consent must be clear, free and informed. It has to be given for specific purposes, not bundled into a general terms of service click. A request to join a newsletter cannot be tied to entering a contest. Each purpose needs its own permission.

Law 25 consent requirements also demand that consent be easy to withdraw. If someone opts out of a mailing list, the withdrawal must work as simply as the opt-in. That means a working unsubscribe link, a reply mechanism for SMS, and a process for event follow-ups.

Under Law 25, consent must be requested separately from any other information a person receives. A privacy policy cannot serve as consent. The law expects a distinct action, such as ticking a box or replying to a message, that signals agreement.

The law also covers secondary use. If a PR team collects emails for a product launch and later wants to invite those people to a webinar, that new purpose needs fresh consent unless it falls under a narrow exception. The safest approach is to name possible future uses when consent is first captured.

For campaigns that rely on third-party data, the rules tighten further. Buying a list of Quebec contacts and emailing them without proof of consent exposes the sender to complaints. The law places the burden on the organization using the data, not just the list vendor.

A messaging framework that holds up should include the consent language as a core element, not an afterthought. When the message and the permission are built together, the campaign avoids retrofits later.

PIPEDA and Law 25 side by side: where the duties diverge

PIPEDA sets the federal baseline for private-sector organizations handling personal information. It applies across Canada, including Quebec, but Quebec's Law 25 is deemed substantially similar. In practice, Quebec-based campaigns follow Law 25, while campaigns reaching the rest of Canada often follow PIPEDA.

PIPEDA requires consent for the collection, use or disclosure of personal information. It allows implied consent in some situations, such as when a person volunteers an email for a clear purpose. Law 25 narrows that room. Quebec's law prefers explicit consent and makes bundled consent harder to defend.

Breach notification differs too. PIPEDA requires organizations to report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada and to notify affected individuals. Law 25 adds its own timeline and a provincial regulator, the Commission d'accès à l'information du Québec.

Retention is another split. PIPEDA expects organizations to keep personal information only as long as necessary, but it does not prescribe a schedule. Law 25 requires organizations to establish and publish retention periods, and to destroy data once the purpose is fulfilled.

The privacy officer role is explicit under Law 25. The law requires an organization to designate a person responsible for the protection of personal information. PIPEDA expects accountability but does not mandate a titled officer in the same way.

A common marketing communications strategy questions list helps teams map which law applies to each campaign. If the audience is in Quebec, assume Law 25 governs, even if the organization is based in Ontario.

The Office of the Privacy Commissioner of Canada publishes a summary of privacy laws in Canada that helps teams see how PIPEDA and provincial statutes interact. Use it to brief legal and communications staff before a national campaign launches.

Retention schedules and privacy officer duties under Law 25

Retention duties under Law 25 require more than a vague policy. The organization must set specific retention periods for each category of personal information. A media contact list, a contest entry database and an event registration file can each have a different schedule.

Once the purpose is complete, the data must be destroyed or anonymized. Keeping old contact lists "just in case" is not a defensible practice. The law expects a documented destruction process, including who authorizes it and how it is verified.

A privacy officer must be designated and their contact details published. This person handles access requests, complaints and internal questions. In a PR agency, that role might sit with a senior operations lead rather than a lawyer.

The privacy officer also oversees consent records. If a journalist asks how their email was obtained, the officer should be able to produce the source, the date and the purpose. That record is the difference between a routine reply and a complaint.

Retention schedules should be reviewed at least annually. Campaigns change, vendors change and the data categories change. A schedule written for a 2024 launch may not fit a 2026 program.

The Commission d'accès à l'information du Québec provides guidance on these duties. The Ministère de la Cybersécurité et du Numérique outlines the Law 25 obligations and timelines, including the phased introduction of retention and privacy officer requirements.

When briefing agencies, include retention in the scope. A crtc broadcast pr rules discussion should cover data handling, not just creative hours. Otherwise the retention work lands on the client after the campaign ends.

Breach notification: the Commission d'accès à l'information du Québec timeline

Breach notification duties under Law 25 require an organization to report any breach of security safeguards that presents a risk of serious injury. The report goes to the Commission d'accès à l'information du Québec. The organization must also notify affected individuals when the risk is serious.

The timeline is prompt. The law expects notification with diligence, which in practice means as soon as the organization becomes aware of the breach and has enough information to report. Delays need a documented reason.

The report to the Commission must include the circumstances, the personal information affected, the number of people concerned and the measures taken. A follow-up report may be required if the investigation reveals more.

Affected individuals need clear language, not legalese. The notice should explain what happened, what data was involved and what steps the person can take. A PR team often drafts this notice with legal review.

Breach notification Quebec rules also require the organization to keep a register of all breaches, even those not reported. The register helps show a pattern of compliance and supports the annual review.

PIPEDA has a parallel duty. The Personal Information Protection and Electronic Documents Act sets out the federal breach reporting requirements for organizations under federal jurisdiction. A campaign reaching both Quebec and Ontario may need to satisfy both regimes.

The Office of the Privacy Commissioner of Canada explains what PIPEDA covers for organizations handling personal information in campaigns. Its PIPEDA overview is a useful starting point for teams building a national breach plan.

For a French-language comparison, the OPC publishes a French overview of Canadian privacy laws. That page helps Quebec teams align internal training with both regimes.

Consent language for Quebec email, SMS and event campaigns

Consent language must be specific to the channel. An email opt-in does not cover SMS. A badge scan at a Montreal trade show does not automatically allow a follow-up sales call. Each channel needs its own permission.

For email, the consent statement should name the sender, the purpose and the frequency. It should also explain how to withdraw. A generic "we may contact you" line is too broad for Law 25 consent requirements.

For SMS, the consent must be captured separately and the opt-out must work by reply. Quebec's language rules also apply: commercial messages to consumers in Quebec generally need to be in French, unless an exception applies.

For events, the registration form should ask for consent to follow-up communications as a separate item. Scanning a badge for lead capture is not consent for a newsletter. The form should make the distinction clear.

Contests add another layer. Quebec's contest rules require specific disclosures, and the personal information collected cannot be used for unrelated marketing without consent. A separate checkbox is the safer route.

When drafting these lines, involve the people who run the campaign. A ftc influencer disclosure rules review can surface whether the vendor understands Quebec's consent standard before the work begins.

Working with agencies and vendors on Quebec Law 25 PR campaigns

Agencies and vendors that handle Quebec personal information are subject to the same duties. A media monitoring service, an email platform and a freelance list broker all count. The client remains accountable for what they do with the data.

Contracts should state the purpose, the retention period and the breach notification process. They should also require the vendor to report a breach to the client without delay, so the client can meet its own reporting duty.

Vendors outside Quebec are not exempt. If a Toronto agency runs a campaign targeting Montrealers, Law 25 applies to the data. The contract should name the law and describe how the vendor will comply.

Sub-processors matter too. An email platform may use a cloud provider in another country. The client should know where the data resides and what happens if the sub-processor has a breach.

Training is part of the vendor relationship. The agency's staff should know how to handle an access request, a withdrawal of consent and a breach report. A short annual briefing is enough for most teams.

When comparing proposals, ask how the vendor handles retention and deletion. A marketing communications strategy development review can be adapted to include privacy questions, so the review covers both outreach and data handling.

Audit trail: documenting consent, retention and breach response

The audit trail is the evidence that the campaign followed the law. It should include the consent text, the date and time of consent, the channel and the source. Without that record, a complaint is hard to answer.

Retention records should show when data was collected, when it was due for review and when it was destroyed. A simple table can track this across campaigns.

Breach records should include the date discovered, the date reported, the people notified and the remedial steps. The register should be reviewed by the privacy officer each quarter.

Use this checklist to test a campaign before launch:

• Consent language names the sender, purpose and withdrawal method.
• Each channel has its own opt-in record.
• Retention period is set and documented.
• Privacy officer contact is published.
• Vendor contracts include breach reporting.
• Breach register is current.
• French-language version of consent text is available.

A table helps compare the two regimes at a glance.

Duty	PIPEDA	Law 25
Consent standard	Implied consent allowed in some cases	Explicit consent preferred
Retention schedule	Reasonable retention required	Specific periods required and published
Breach reporting	Report to OPC and notify individuals	Report to Commission d'accès à l'information du Québec and notify individuals
Privacy officer	Accountability expected	Designated officer required
Language	Federal, English and French	French obligations for Quebec consumers

Common questions

Does Law 25 apply to a PR campaign run from outside Quebec? Yes, if the campaign collects or uses personal information of people in Quebec. The law follows the data, not the office address.

What is the difference between PIPEDA and Law 25 for consent? PIPEDA allows implied consent in more situations. Law 25 expects explicit consent for each purpose and makes withdrawal easy.

Who is the privacy officer under Law 25? A person designated by the organization to protect personal information. Their contact details must be published, and they handle access requests and complaints.

How fast must a breach be reported in Quebec? Promptly, once the organization has enough information to report. The report goes to the Commission d'accès à l'information du Québec, and affected people must be notified if the risk is serious.

Do event badge scans count as consent? Not for unrelated marketing. The registration form should ask for follow-up consent as a separate item, and the badge scan alone is not enough.

How long can a PR team keep a media list? Only as long as the purpose requires, with a documented retention period. Once the purpose ends, the data should be destroyed or anonymized.