Quebec's Law 25 (formerly Bill 64) is the strongest privacy law in Canada and the closest thing to the GDPR on Canadian soil. It grants an actual right to deletion and a right to de-indexation, and it is enforced by the Commission d'accès à l'information with fines reaching CAD $25 million or 4% of worldwide turnover. This is what you can demand, and how.
Why Law 25 matters more than PIPEDA
Quebec's Law 25, adopted as Bill 64 and phased in between 2022 and 2024, modernised the province's private-sector privacy regime and moved it well beyond the federal PIPEDA standard. Where PIPEDA is built around consent management and gives no standalone right to erasure, Law 25 introduces an explicit right to have personal information deleted, a right to de-indexation, data portability, and a right to be informed when a decision about you is made by automated processing.
This matters practically: if the organisation is in Quebec and the information is processed there, you are not arguing from a consent principle. You are exercising a named statutory right, and the organisation has to answer it.
What Law 25 grants you
The core rights, as set out in Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, include:
The deletion right is the one people underuse. Its trigger is necessity: once the purpose is spent, the information has to go. That is a different and often easier argument than the consent-based reasoning you would have to use under PIPEDA.
- Access: confirmation of whether personal information about you is held, and access to it.
- Correction: correction of inaccurate, incomplete or ambiguous information, and the right to have third parties who received it notified.
- Deletion (droit à l'effacement): deletion of information that is no longer necessary for the purposes for which it was collected, or that was collected unlawfully.
- De-indexation: the right to require that a hyperlink giving access to your information be de-indexed where it causes you serious injury and the conditions of the Act are met.
- Portability: receiving your computerised personal information in a structured, commonly used format, and having it transferred to another organisation where technically feasible.
- Information about automated decisions: being told when a decision based exclusively on automated processing has been made about you, and being able to ask for the details and to have the decision reviewed.
How to file a deletion request with the business
Every Quebec business must designate a person responsible for the protection of personal information, and that is who your request goes to. Address them by that title. State that you are exercising your rights under the Act respecting the protection of personal information in the private sector, as amended by Law 25, and be explicit about what you want: deletion, correction, de-indexation, or a combination.
Identify the information precisely — account records, transaction history, marketing profiles, call recordings, uploaded documents, comments, images. Give the reason the necessity condition is met: the account is closed, the contract ended, the retention period elapsed, the information was collected without a valid basis. Ask for written confirmation of what was done, and ask which third parties received the information so the deletion can cascade.
The deadlines, and what to do if they pass
The organisation must respond within 30 days of receiving your request. It may extend that period in limited circumstances with written notice to you explaining the reason — but silence is not an option, and a refusal must be motivated and in writing. If you get nothing, or you get a refusal you think is wrong, you have a specific statutory remedy rather than a vague grievance.
Keep everything. Date the request, keep the delivery confirmation, save every reply. The CAI process is documentation-driven, and a clean timeline is most of the work of a successful complaint.
Complaining to the Commission d'accès à l'information
The Commission d'accès à l'information du Québec (CAI) is the regulator, and unlike the federal OPC it has genuine coercive powers. You can ask the CAI to examine a disagreement over the exercise of your rights, and the CAI can order the organisation to comply. Non-compliance with a CAI order can itself lead to prosecution.
The financial exposure under Law 25 is significant, and it is not theoretical: penalties can reach CAD $25 million or 4% of worldwide turnover for the most serious offences, with separate penalties available for individuals who participate in a breach, including officers and directors. When an organisation's privacy team looks at a well-documented deletion demand, that exposure — not goodwill — is what gets a response.
De-indexation: the right that changes search results
Article 28.1 of the Act gives a person the right to require a search engine or the operator of a platform to stop indexing a hyperlink giving access to their information, where that information causes serious injury and the conditions in the Act are satisfied. The injury must be serious, and the balance can go against you where the public interest in the information, or the public's right to be informed, outweighs it.
This is the closest Canadian analogue to the GDPR's search delisting, and it is specifically a Quebec right. It is also where a campaign needs the most care: each hyperlink has to be assessed on its own, the injury has to be evidenced, and the public-interest argument will be raised. Blanket de-indexation requests get refused; targeted, well-argued ones sometimes succeed.
How to run this properly
The work is a two-stage exercise: an audit to find everything that is out there and identify which pieces you actually have a lawful right to attack, then a prioritised campaign that runs the strongest requests first while the weaker ones are assessed. Deletion, correction, de-indexation and portability are different requests with different tests, and mixing them in one letter is a common reason they fail.
We handle the audit and the correspondence, and we are direct about the limits. A regulator with real teeth and a named statutory right does not mean every request succeeds: some records are retained on legal grounds, some refusals are correct, and the de-indexation test is genuinely hard. What a paid service buys you is a properly reasoned, properly documented demand built on the right article of the right statute — not a promise about the outcome.