Law 25 Compliance with Microsoft 365
Quebec's privacy law applies to every business, whatever its size. We turn its security duties into Microsoft 365 controls you can show the CAI.
Talk to us about Law 25The law is fully in force. The CAI is enforcing it.
Law 25 modernized Quebec's private sector privacy law in three stages, and every obligation has applied since September 22, 2024. It covers businesses of every size. The Commission d'accès à l'information (CAI) can impose administrative penalties of up to $10 million or 2% of worldwide turnover, and penal fines reach $25 million or 4%.
Much of the law is governance: a privacy officer, policies, consent. A large part lands on IT, though. Personal information has to be protected with proportionate security, incidents have to be recorded, and you need to know where data is stored. In most small businesses, that data lives in Microsoft 365.
We map Law 25 duties to Microsoft 365 controls, configure them, and keep the evidence a CAI file asks for. We are an IT provider, not a law firm. For legal interpretation, work with your lawyer or a privacy professional, and we will handle the technical side alongside them.
This is for you if:
- You collect personal information from clients, patients or employees
- That information lives in Outlook, SharePoint, OneDrive or Teams
- You have a privacy officer on paper but no technical controls behind it
- You have no incident register, or it has never been put to use
- Your cyber insurer or a client has asked about Law 25
The controls behind your obligations
Access and identity
Multifactor authentication, Conditional Access and blocked legacy sign-ins, so only the right people reach personal information.
Labels and data loss prevention
Purview sensitivity labels and DLP rules that warn before personal information leaves the company, then block once staff are used to them.
Audit logs
The unified audit log switched on before you need it, with eDiscovery for access and portability requests.
Incident response
Defender for Business alerts, a containment runbook and an incident register kept for five years, as the law requires.
Data residency
A documented map of where each Microsoft 365 workload stores data, ready for your privacy impact assessments.
Retention and destruction
Retention policies that keep personal information as long as it is needed and dispose of it afterwards, instead of forever.
When something goes wrong
Law 25 requires you to notify the CAI and the people affected, with diligence, when a confidentiality incident presents a risk of serious injury. There is no fixed 72-hour deadline; that is a rule from Europe's GDPR. Every incident, serious or not, must be recorded in a register kept for five years, and the CAI can ask to see it at any time.
Credential compromise is the most common incident we see. Our runbook covers the first hours: isolate the device in Defender, block sign-in and revoke sessions in Entra ID, pull the audit log, then assess the risk of injury. Managed clients get the register and runbook maintained for them.
- Notify the CAI and individuals when there is a risk of serious injury
- Record every incident in a register kept for five years
- Weigh sensitivity, consequences and the likelihood of misuse
- Keep audit logs on so you can tell what was accessed
Transfers outside Quebec and privacy impact assessments
Before personal information leaves Quebec, including to another province, Law 25 requires a privacy impact assessment. It weighs the sensitivity of the data, the purpose, the protections in place and the legal framework at the destination, and the protection must be backed by a written agreement.
For Canadian tenants, Microsoft 365 data replicates between Quebec City and Toronto, so it already leaves Quebec. Entra ID, Intune and Microsoft Forms store data in the United States. We document each workload so your assessment reflects how your tenant actually works.
From Law 25 gaps to documented controls
Gap assessment
We review your tenant against Law 25's security duties: access, labels, logging, retention and incident handling.
Priority fixes
Multifactor authentication, Conditional Access and audit logging come first, because they matter most when something happens.
Data protection
Sensitive information types, labels and DLP rules are rolled out in warning mode, then enforced.
Evidence and upkeep
The register, the runbook and the configuration records are kept current and ready for a CAI request.
Law 25 also requires you to publish your privacy officer's name, title and contact details on your website. It takes minutes and is easy to overlook.
Find out where your Law 25 gaps are
Tell us how your business handles personal information and we will show you which Microsoft 365 controls are missing, with a quote to close the gaps.
Frequently Asked Questions
Does Law 25 apply to small businesses?
Yes. Law 25 applies to every business that collects personal information in Quebec, whatever its size. All of its obligations have been in force since September 22, 2024.
Is there a 72-hour deadline to report a breach?
No. The 72-hour deadline comes from Europe's GDPR. Law 25 requires you to notify the CAI and the people affected with diligence when an incident presents a risk of serious injury, and to record every incident in a register.
What are the penalties under Law 25?
The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, whichever is greater. Penal fines can reach $25 million or 4% of worldwide turnover, doubled for repeat offences.
Is storing data in Microsoft 365 compliant with Law 25?
It can be, with the right controls and documentation. Data in Canadian tenants replicates between Quebec City and Toronto, and some services store data in the United States, so a privacy impact assessment is required. Security settings such as multifactor authentication, labels and audit logs also have to be in place.
Which Microsoft 365 plan do we need for Law 25?
Business Premium covers the core controls: sensitivity labels, data loss prevention, Conditional Access and audit logging. Enterprise E5 adds advanced eDiscovery and insider risk tools, which most small businesses do not need.
Who should be our privacy officer?
By default it is the person with the highest authority in the business, such as the owner or president. The role can be delegated in writing, and the officer's name, title and contact details must be published on your website. We support the officer with the technical controls, records and incident handling.