Bill 25 Isn't a Theoretical Threat Anymore
Since it was passed, plenty of Quebec businesses have treated Bill 25 as a "someday" checkbox item. In 2026, that math doesn't work anymore. The penalty regime is now fully in force, and the Commission d'accès à l'information (CAI) is putting it to use.
If your SMB holds personal information belonging to customers, patients, or employees, here's what you need to know. For the basics, our complete guide to Bill 25 compliance and our eighteen-month check-in are still solid starting points.
Penalties That Actually Sting
Bill 25 sets out two levels of penalties, and they're among the toughest in Canada.
First, the CAI can hand out administrative monetary penalties directly, without going through the courts, up to $10 million or 2% of worldwide revenue, whichever is higher.
Then there's the criminal route: if charges are laid, fines can reach $25 million or 4% of worldwide revenue, and they double for repeat offenses.
None of this is reserved for the big players. It applies to any organization that drops the ball on its obligations.
The Private Right of Action: The Risk Nobody Sees Coming
Beyond the fines, Bill 25 also creates a private right of action, meaning individuals can sue a company in court, either on their own or through a class action. When a breach is intentional or results from gross negligence, the law allows for punitive damages of at least $1,000 per person, on top of compensation for actual harm.
Here's the part that catches people off guard: these lawsuits can be filed as class actions. A single leak affecting a few hundred customers can snowball into a claim worth several hundred thousand dollars, completely separate from anything the CAI might impose.
What the CAI Is Watching For
The Commission can penalize a business for things like:
Bottom line: skipping protective measures isn't just a bad habit anymore. It's a punishable offense.
Where to Start
Getting compliant with Bill 25 doesn't have to feel overwhelming. The groundwork is well within reach for an SMB:
Know What You've Got
You can't protect what you don't know about. Start by taking stock of the personal information you hold and where it actually lives.
Put Reasonable Security Measures in Place
Multi-factor authentication, backups, access controls, encryption: the safeguards the law expects are the same ones that protect you from a cyberattack.
Have a Response Plan Ready
When an incident happens, you're on the clock with specific reporting obligations. A plan you've already worked out ahead of time is what separates a controlled response from a full-blown crisis.
Name Someone Responsible
The law requires a designated person responsible for protecting personal information. That role needs to be clearly defined and documented.
Bottom Line
In 2026, Bill 25 has teeth. The penalties are real, the CAI is actively enforcing them, and individual lawsuits add a layer of risk a lot of businesses never saw coming. Here's the silver lining though: the same measures that get you compliant are the ones that make your business more secure overall.
At AIKI Secure, we help Quebec SMBs assess their Bill 25 compliance and put the right measures in place, no jargon. For an assessment, get in touch with us or call 514-939-3222.
