AI law comparison · Data verified 2026-08-22
Canada PIPEDA vs Québec Law 25
Canada PIPEDA and Québec Law 25 are two of the 169 AI and data regulations Aegis Firma tracks. They have different scopes, effective dates, and penalties — and many businesses fall under both. Here is the side-by-side, drawn directly from the regulatory registry.
Find which laws apply to my businessSide by side
Summary of publicly available regulatory text. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
The key difference
Canada PIPEDA takes effect first, so it is usually the more urgent of the two. Canada PIPEDA tracks 4 compliance requirements and Québec Law 25 tracks 4. They are not interchangeable — meeting one does not discharge the other. The practical question is not which law is “stricter,” but which of them — or both — actually applies to your business.
Canada PIPEDA — AI & Automated Decision-Making (Post-C-27 Framework)
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs AI and automated decision-making involving personal data of Canadians. Following the death of Bill C-27 (AIDA + CPPA) in January 2025 when Parliament prorogued, PIPEDA remains Canada's primary federal data protection law. Organizations must obtain meaningful consent to use personal data in AI models, explain significant automated d…
Full Canada PIPEDA requirementsQuébec Law 25 — Automated Decisions & Privacy (Act 25 / Bill 64)
Québec's Act to modernize legislative provisions respecting the protection of personal information (Law 25 / Bill 64) is Canada's strictest provincial privacy law, fully in force since September 22, 2024. Section 12.1 requires organizations to disclose when decisions significantly affecting individuals are made exclusively by automated means (AI), explain the factors involved on request, and allow individuals to pres…
Full Québec Law 25 requirementsCommon questions
Could both Canada PIPEDA and Québec Law 25 apply to my business?
Yes. Canada PIPEDA and Québec Law 25 are separate regulations with separate scopes — a business can fall under both at once. Canada PIPEDA covers PIPEDA applies to private-sector organizations that collect, use, or disclose personal information in the course of commercial activities across provincial or i… Québec Law 25 covers Applies to any enterprise (including non-profits and foreign entities) that collects, holds, uses, or communicates personal information about Québec residents i… If your operations meet both scopes, you must comply with both. Aegis Firma's free scan checks all 169 tracked regulations against your business profile so you do not have to read each law to find out.
Which has the higher maximum penalty — Canada PIPEDA or Québec Law 25?
Canada PIPEDA: PIPEDA itself has NO general administrative monetary penalty for ordinary non-compliance — the OPC cannot impose fines directly; its enforcement tools are investigation findings, compliance agreements, and application to the Federal Court for an enforcement order (Federal Court proceedings are a fresh hearing, not a review of OPC findings). A CAD $100,000-per-offence CRIMINAL penalty exists under PIPEDA s.28, but only for specific offences: destroying personal information subject to an access request, retaliating against a whistleblower, or failing to report a breach as required — not for general AI-consent or profiling violations. A proposed replacement bill, C-36 (Protecting Privacy and Consumer Data Act / PPCDA, introduced 2026-06-15, NOT YET LAW), would give the successor Commission real administrative-monetary-penalty power: up to CAD $10M or 3% of global revenue (standard non-compliance) and up to CAD $25M or 5% of global revenue (most serious offences). Québec Law 25: Two-tier: (1) CAI-imposed Administrative Monetary Penalties, up to the greater of C$10,000,000 or 2% of worldwide turnover; (2) court-imposed penal fines (Section 91 offences, CAI-initiated prosecution), C$15,000 to the greater of C$25,000,000 or 4% of worldwide turnover, doubled for repeat offences. Penalty structures differ by regulator and violation type — read each law's full page for the cure periods and per-violation detail.
When does each law take effect?
Canada PIPEDA — effective 2001-01-01. Québec Law 25 — effective 2023-09-22, enforcement from 2024-09-22. Dates last verified against official sources on 2026-08-22 and 2026-08-22 respectively.
Related comparisons
Stop guessing which laws apply
Answer a short questionnaire about your business and Aegis Firma tells you exactly which of 169 regulations apply — and what each one requires you to do.
Start free compliance scan