HackFirstAidEducation
Regulatory grid

State overlay · QC

Québec

Loi 25 (Law 25, formerly Bill 64) + Education Act

Québec's Loi 25 imposes Canada's strictest privacy regime on public bodies including centres de services scolaires (CSS) and school boards. A Privacy Officer is mandatory and Privacy Impact Assessments are required for new systems.

Notification window

Loi 25 requires notification to the Commission d'accès à l'information (CAI) and affected individuals 'with diligence' (sans délai) when a confidentiality incident presents a risk of serious injury.

Regulators

Commission d'accès à l'information (CAI)

cai.gouv.qc.ca incident reporting form (in French).

Ministère de l'Éducation (MEQ)

Notify your CSS Direction générale and the MEQ.

Canadian Centre for Cyber Security (CCCS)

contact@cyber.gc.ca (English/French).

Unique gotchas

  • All family notifications must be in French; English versions are supplementary, not primary.
  • Loi 25 carries administrative monetary penalties up to 4% of worldwide revenue or $25M — among the highest in Canada.
  • A register of confidentiality incidents must be maintained and is auditable by the CAI.

Testing authority

MEQ épreuves uniques (provincial ministry exams)