Governance, risk & compliance

Quebec Access Act, public sector (as modernized by Law 25) CQLR c A-2.1, as amended by SQ 2021, c 25

Read 24 Oct 2026.

The Act respecting Access to documents held by public bodies and the Protection of personal information, CQLR c A-2. 1, as amended by An Act to modernize legislative provisions as regards the protection of personal information (Bill 64, S.

Q. 2021, c.

25, assented to 22 September 2021). The amendments were read in the annual statute, not in a consolidated version of the Access Act, and the unamended sections (for example the security duty in s.

63. 1) were not read.

Under s. 175 of Law 25 the provisions came into force on 22 September 2023, except some that came into force on 22 September 2022 (including the person in charge and the committee in ss.

8 and 8. 1, and the confidentiality incident sections 63.

8 to 63. 11) and portability (s.

30 of Law 25, 22 September 2024). Public sector duties: the highest authority is the person in charge of access and of protection of personal information (s.

8) and a body must have a committee on access to information and the protection of personal information (s. 8.

1); consent must be clear, free, informed, specific and time-limited (s. 53.

1) and express for sensitive information (s. 59); publish governance rules on personal information (s.

63. 3) and, when collecting by technological means, a confidentiality policy (s.

63. 4); privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system, with the committee consulted from the start (s.

63. 5); highest confidentiality settings by default (s.

63. 7); a confidentiality incident that presents a risk of serious injury must be notified promptly to the Commission d’accès à l’information and to the people concerned (s.

63. 8) and logged in a register (s.

63. 11); notice at collection (s.

65), including identification, location or profiling technology (s. 65.

0. 1); notice of decisions based exclusively on automated processing (s.

65. 2); written agreements for mandataries and contractors (s.

67. 2) and for research disclosures (ss.

67. 2.

1 to 67. 2.

3); a privacy impact assessment before release outside Québec (s. 70.

1). Offences: s.

158 ($1,000 to $10,000 natural persons, $3,000 to $30,000 others) including failing to report an incident, and s. 159 ($5,000 to $100,000, $15,000 to $150,000) including failing to take security measures; fines double for a repeat offence (s.

164. 1) and proceedings must start within five years (s.

164. 2).

This pack found no administrative monetary penalty regime for public bodies in the Law 25 text; the private sector regime stays in QC_LAW25. Health and social services bodies are also governed by QC_HSSI for health and social services information.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Quebec Access Act, public sector (as modernized by Law 25) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Quebec Access Act, public sector (as modernized by Law 25) compliance

Most of Quebec Access Act, public sector (as modernized by Law 25) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Quebec Access Act, public sector (as modernized by Law 25), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Quebec Access Act, public sector (as modernized by Law 25) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Quebec Access Act, public sector (as modernized by Law 25) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.