TL;DR: Quebec’s Law 25 gives you six practical rights over your personal information held by companies: access, rectification, withdrawal of consent, de-indexing/stopping dissemination, information about automated decisions, and portability. Companies must respond within 30 days, access requests are generally free, and if they refuse or ignore you, you can complain to the Commission d’accès à l’information (CAI). Here’s how each right works in plain language.
The six rights at a glance
Based on the section-by-section breakdown from Hilotech’s Law 25 guide:
| Right | What it lets you do | In force |
|---|---|---|
| Access | Get a copy of your data, where it came from, how it’s used, who received it, how long it’s kept | Before Law 25 |
| Rectification | Fix inaccurate, incomplete or "equivocal" data | Before Law 25 |
| Withdraw consent | Pull consent at any time, through a simple free mechanism | Sept 2023 |
| De-indexing / stop dissemination | Ask a company to stop spreading your data or de-index it | Sept 2023 |
| Automated decisions | Learn the data, reasons and factors behind a decision made only by a machine | Sept 2023 |
| Portability | Get your data in a structured, common format, or have it sent to another company | Sept 22, 2024 |
1. Right of access
Send a request by email, letter, phone or the company’s form. After verifying your identity, the company must give you a copy of your information and details on its source, use, recipients and retention. If it refuses, the refusal must be in writing, with reasons, and must tell you about your right to go to the CAI.
2. Right to rectification
If information is wrong, incomplete or ambiguous, ask for a correction. On request, the company must also tell third parties who received the bad data in the last six months. They can only refuse if the request is manifestly unfounded.
3. Withdrawing consent
You can withdraw consent at any time through a simple, free mechanism like a link, form or email. It works going forward, not retroactively, and the company must tell you the consequences (for example, "we can’t send you rewards without your email").
4. De-indexing: Quebec’s "right to be forgotten"
You can ask a company to stop disseminating your personal information or de-index it, for example from a link or search result. The bar is real: the dissemination must cause serious harm that clearly outweighs the public interest, and a less drastic fix must not be enough. It’s not a delete-anything button, but it’s more than most Canadians have.
5. Automated decisions
If a decision with legal or significant effect on you was made entirely by automated processing, you can ask what personal information was used, the main reasons and the factors behind it, and correct the data used.
6. Data portability
Since September 22, 2024, you can request computerized data you provided (or that came from your use of a service) in a structured, commonly used format, or ask for it to go straight to another organization. The company’s own analyses and scores don’t count.
How to make a request
- Find the company’s privacy officer (Law 25 requires one; contact details are usually in the privacy policy).
- Send a short written request stating which right you’re using.
- Keep a copy and note the date.
- Expect an answer within 30 days. The clock starts when the company receives it, not when it reaches the right desk. Extensions are possible for complex requests, but they have to tell you before the 30 days run out.
- Access is generally free; only moderate fees for copying or transmission are allowed.
If they refuse or ghost you
File a complaint with the Commission d’accès à l’information (CAI). It can investigate, order corrections and impose administrative sanctions.
Outside Quebec, federal law (PIPEDA) applies instead. See our PIPEDA explainer and how to complain to the federal Privacy Commissioner.
How the CAI complaint form works
The Commission d’accès à l’information runs an online complaint form that anyone can use to report a privacy or access practice by a company, a public body or a health and social services organisation. Know what to expect:
- The CAI doesn’t represent you or settle your personal dispute with the company.
- It won’t keep you updated on the complaint’s progress or result, and doesn’t issue a file number.
- It will contact you only if it needs more information.
That makes a complaint a tool for getting a practice looked at, not for getting your own data back. If a company refused your access or rectification request, the form links to a separate review request (demande de révision) process, which is the route for your individual case.
Where to start
Most people don’t know which companies hold their data. A free exposure check shows which breaches your email appears in, which is a good list of who to send access requests to first.
Frequently Asked Questions
Will the CAI keep me updated on my privacy complaint?
No. The CAI says it won’t keep complainants informed of progress or results, and only gets in touch if it needs more information. For a refused access request, use its separate review request process.
What rights does Quebec Law 25 give individuals?
Access, rectification, withdrawal of consent, de-indexing or stopping dissemination, information about automated decisions, and data portability.
How long does a company have to respond to a Law 25 request?
30 days from receiving the request, with a possible extension if you’re notified before the deadline.
Is there a right to be forgotten in Quebec?
Yes, in limited form. You can ask a company to stop disseminating or de-index your information if it causes serious harm that outweighs the public interest.
Where do I complain about a Law 25 violation?
To the Commission d’accès à l’information (CAI).
When did data portability start under Law 25?
September 22, 2024.