---
title: "Quebec Law 25 — Private Sector personal-information modernisation — KYE Protocol™ coverage"
description: "Quebec Law 25 — Private Sector personal-information modernisation coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/quebec-law-25/
lang: en
source: "KYE Protocol"
---

> Quebec Law 25 — Private Sector personal-information modernisation coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

Quebec Law 25 — Private Sector personal-information modernisation

# Quebec Law 25 — Private Sector personal-information modernisation — 80% of in-scope requirements covered.

5 requirements · 5 in scope (3 enforced · 2 designed). The 80% is weighted over the in-scope base.

**Source:** An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25 (Law 25 / former Bill 64), amending the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1). Privacy-impact-assessment duty (s.3.3), automated-decision transparency + right to submit observations (s.12.1 / s.65.2), confidentiality-incident reporting to the CAI (s.3.5-3.8), data portability (s.27), and consent for sensitive information (s.12).

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| Privacy impact assessment (s.3.3) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Automated-decision transparency (s.12.1) | 1 | 1 | 0 | 0 | 0 | **100%** |
| Confidentiality-incident reporting (s.3.5-3.8) | 1 | 0 | 1 | 0 | 0 | **50%** |
| Data portability (s.27) | 1 | 0 | 1 | 0 | 0 | **50%** |
| Consent for sensitive information (s.12) | 1 | 1 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `quebec-law-25.s3.3` | Section 3.3 — Privacy impact assessment: conduct a PIA before any project to acquire, develop or overhaul an information system or electronic-service-delivery system involving personal information | enforced | **audit\_events**: `kye.risk_assessment.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `quebec-law-25.s12.1` | Section 12.1 — Automated decision-making: when a decision is based exclusively on automated processing, inform the individual and, on request, of the personal information used, the reasons and principal factors, and the right to submit observations | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.replay.proof.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `quebec-law-25.s3.5` | Sections 3.5-3.8 — Confidentiality incidents: keep a register of incidents and, where there is a risk of serious injury, notify the Commission d'accès à l'information and the affected individuals | designed | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `quebec-law-25.s27` | Section 27 — Data portability: on request, communicate computerised personal information collected from the individual in a structured, commonly used technological format | designed | **audit\_events**: `kye.evidence.pack.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `quebec-law-25.s12` | Section 12 — Use limitation + consent for sensitive information: personal information must be used only for the purposes for which it was collected, and express consent is required for sensitive personal information | enforced | **audit\_events**: `kye.purpose.request.v1`, `kye.purpose.admissibility.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).