Act Respecting the Protection of Personal Information in the Private Sector (Québec)

Where this applies

This record is scoped to Québec. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.

Instrument

Act respecting the protection of personal information in the private sector, CQLR c. P-39.1

Who it binds

Private-sector businesses handling personal information within Québec.

What it requires

Québec's own private-sector privacy law requires a business to designate a person in charge of the protection of personal information — by default the person exercising the highest authority in the business, who may delegate the function in writing. Where this law applies to a Québec business's activity, it takes the place of the federal PIPEDA for that activity; PIPEDA continues to apply to cross-border transfers and to federally regulated businesses.

Related records and requirements

• Technology and Data — Applies if you're a private-sector business handling personal information within Québec.
• Finance and Professional Services — Applies if you're a private-sector business handling personal information within Québec.
• Personal Information Protection and Electronic Documents Act (PIPEDA) (Canada) — PIPEDA is Canada's federal general-compliance data-protection law, binding organisations that collect, use or disclose personal information in the course of commercial activity.
• Privacy Act 1988 — Australian Privacy Principles (Australia) — The Privacy Act 1988 binds Australian government agencies and covered organisations to 13 Australian Privacy Principles — the small-business turnover exemption has documented exceptions.
• Act on the Protection of Personal Information (APPI) compliance (Japan) — APPI's general obligations (Art. 21(1) purpose notification, Art. 23 security-management measures) bind business operators handling personal information in Japan.
• Personal Data (Privacy) Ordinance compliance (Hong Kong SAR China) — Hong Kong's Cap. 486 sets six Data Protection Principles binding data users in Hong Kong, overseen by the PCPD.
• Personal data protection compliance (Vietnam) — Vietnam's Decree 13/2023 and, from 1 January 2026, Law 91/2025 bind organisations processing personal data in Vietnam to a general data-protection compliance regime.
• Federal personal data protection compliance (Mexico) — Mexico's federal private-sector data-protection law, replaced in full on 20 March 2025, binds private-sector personal-data processing nationwide.
• Personal Data Protection Law (PDPL) compliance (Saudi Arabia) — Saudi Arabia's PDPL (Royal Decree M/19) binds entities processing personal data in Saudi Arabia to a general data-protection compliance law.
• Federal personal data protection compliance (United Arab Emirates) — The UAE's federal PDPL (Federal Decree-Law No. 45 of 2021) binds organisations processing personal data inside or outside the UAE where the processing relates to the UAE — separate from DIFC's and ADGM's own free-zone regimes.
• Data Protection Officer appointment (Singapore) — Singapore's PDPA s.11(3) requires designating one or more individuals responsible for the organisation's compliance — a distinct duty from any separate PDPC registration channel.
• Data Protection Officer appointment threshold (Germany) — Germany's BDSG §38 requires appointing a Data Protection Officer once an organisation generally employs at least 20 people continuously engaged in automated personal-data processing — a German-specific addition on top of GDPR.