Business security · 9 min read · updated oct 2026
Quebec's Law 25 and Your Security Camera System
By the Pixl Canada install team

Short answer
If your business films people in Quebec, the Act respecting the protection of personal information in the private sector applies to the footage, because a person’s image on a recording is personal information. Law 25 added duties to that Act: a named person in charge, written governance policies, a privacy impact assessment for new systems, an incident register and reporting, and fines of up to $25 million or 4% of worldwide turnover. Collect only what is necessary, tell people with a sign, secure the recordings and delete them on a schedule.
Planning a business camera system? Pixl gives a free walkthrough and a written quote, and you pay after the job. Quebec has its own installer rules, so check that we serve your area before booking. See Pixl for businesses
On this page
Who this law covers
The Private Sector Act applies to personal information that a person collects, holds, uses or communicates while carrying on an enterprise, and it expressly covers information that is “filmed” or “taped” (section 1). The Commission d’accès à l’information (CAI), Quebec’s privacy regulator, states in its video surveillance guide that the image of an identifiable person on a recording is personal information.
That means a shop, restaurant, clinic, warehouse, daycare or office in Quebec that records people is covered, whether the cameras are inside, at the door or in the parking area. A homeowner who films their own porch is not carrying on an enterprise, so the Private Sector Act generally does not apply, but the privacy rights in articles 35 to 40 of the Civil Code of Québec and the Quebec Charter still do. See can my neighbour’s camera point at my house for the home side.
What Law 25 changed for businesses with cameras
Law 25 (2021, chapter 25) amended the Private Sector Act, and most of the new rules took effect on 22 September 2023. The table lists the duties that matter for a camera system, with the section of the Act that creates each one.
| Duty | What the Act says | What it means for cameras |
|---|---|---|
| Person in charge (s. 3.1) | The person with the highest authority in the business holds this role by default and may delegate it in writing. Their title and contact details must be published on the website. | Someone must own the camera system, answer questions and handle access requests |
| Governance policies (s. 3.2) | Written policies on keeping and destroying information, staff roles and a complaints process, approved by the person in charge and explained in plain language on the website | Your retention period and who can view footage belong in writing |
| Privacy impact assessment (s. 3.3) | Required for any project to acquire, develop or overhaul an information system involving personal information, scaled to its sensitivity and scope | A new recorder or cloud camera service is the kind of project to assess before it goes live |
| Incidents (s. 3.5 to 3.8) | Take reasonable steps after an incident, notify the CAI and the people affected if there is a risk of serious injury, and keep a register of all incidents | A stolen recorder or leaked clip needs a plan and a record |
| Notice (s. 8) | Tell people the purposes and means of collection, and their rights of access and rectification | A visible sign at the entrance, plus a contact for questions |
| Identification technology (s. 8.1) | If the technology can identify, locate or profile people, tell them first and explain how to activate those functions | Facial recognition and similar analytics need extra care |
Penalties
The CAI can impose monetary administrative penalties of up to $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater (section 90.12). Penal fines for a business run from $15,000 up to $25 million or 4% of worldwide turnover, whichever is greater, and are doubled for a repeat offence (sections 91 and 92.1). Prosecution can start within five years of the offence (section 92.2). Most small businesses will never see numbers like these, but the law is built so that the duties above are taken seriously.
Planning a business camera system? Pixl gives a free walkthrough and a written quote, and you pay after the job. Quebec has its own installer rules, so check that we serve your area before booking.
The necessity test: do you need cameras at all?
Section 5 of the Act lets a business collect only the personal information that is necessary for a purpose set out in advance, and by lawful means. The CAI explains how it applies that test to cameras in its video surveillance guide, which asks two things.

- Is the purpose legitimate, important, urgent and real? The CAI says to describe the situation with concrete facts, such as how many thefts or incidents occurred. It adds that simple fears, speculation or anecdotes are generally not enough, and that other businesses using cameras does not prove you need them.
- Is the intrusion proportionate? Cameras must be rationally linked to the purpose, clearly more useful than harmful to the people filmed, and limited as far as possible. Ask whether a less intrusive option would work, such as guards, an alarm, door controls or better lighting.
Write the answers down. The CAI recommends a privacy impact assessment (an évaluation des facteurs relatifs à la vie privée, or EFVP) as the tool for this, and it is the natural place to meet the section 3.3 duty at the same time.
Nine practices from the CAI guide
The CAI guide, La vidéosurveillance: conseils pratiques, is dated January 2019 and is marked as under review, so treat it as the regulator’s current published guidance rather than final text. Its practical steps are:

- Adopt a video surveillance policy and name a person responsible.
- Tell people about the cameras with visible signs, and add a phone number for questions.
- Limit the scope: plan how many cameras you need, where they go and when they run, and avoid places with a very high expectation of privacy.
- Secure the recordings: lock the room, limit access, use passwords, have authorized people sign confidentiality commitments and plan for a security incident.
- Limit who can see the images and what they can be used for, and do not share them with third parties without authorization.
- Delete recordings securely as soon as they are no longer needed. The guide says 30 days is generally sufficient and recommended.
- Plan for requests from people who appear on the footage, without revealing other people’s information.
- Public bodies have an extra step, which does not apply to private businesses.
- Review the need and the policy regularly, and stop filming when the purpose is met.
The 30 days is guidance, not a number written into the Act. A longer period needs a reason you can explain.
Where not to point a camera
The CAI lists homes, bedrooms, dormitories, consulting rooms, showers, toilets, changing rooms and fitting rooms as places where people expect the most privacy. Keep cameras out of these areas. Our guides to retail store camera placement and cameras at work show how to cover doors, tills and stock without filming private spaces.
Signs and notice in Quebec
Section 8 requires you to tell people what you collect and why, and the CAI suggests visible signs where cameras operate. A good sign names the business, says that cameras record, gives the purpose and shows a number to call. Quebec’s language rules apply to public signs, so make sure the French text is there and check the requirements for your sign. For wording ideas, read do you need a security camera sign in Canada.
Audio, employees and tenants
- Audio. The CAI guide covers cameras that record “with or without sound”. Audio is more intrusive, and recording private conversations can also break the Criminal Code. Keep it off unless you have a specific, documented need. See is security camera audio recording legal in Canada.
- Employees. The CAI asks whether you should consult the people affected first, such as employees. Tell staff in writing what is filmed and why.
- Tenants and co-owners. The same consultation question applies to tenants and condo owners. Our landlord camera guide covers the rental side.
- Facial recognition and analytics. Section 8.1 applies to technology that identifies, locates or profiles people, and biometric systems have further rules. Get legal advice before using them.
A Quebec camera checklist
- Write the purpose and the facts behind it, and consider less intrusive options.
- Complete a privacy impact assessment before you buy or switch on a system.
- Name the person in charge and publish their title and contact details on your website.
- Write a short camera policy: purpose, camera locations, who can view, retention period, access requests.
- Post signs in French at each entrance with a contact number.
- Lock the recorder, use strong passwords and keep an access list.
- Set a deletion schedule, with 30 days as the CAI’s reference point, and check that it works.
- Keep an incident register and know who to call if footage is lost or leaked.
- Review the setup every year and remove cameras you no longer need.
See the broader security camera laws in Canada guide for the federal and provincial picture, and our guide to giving footage to police for what to do when asked.
Plan a business camera system
Planning cameras for a business? Pixl Canada gives a free walkthrough and a written quote for business camera systems, and you pay after the job. Quebec has its own installer rules, so ask us whether we serve your area before booking. See Pixl for businesses and the business security camera system guide.
Frequently asked questions
Does Law 25 apply to my business cameras in Quebec?
Yes, if your business records identifiable people. The Private Sector Act covers personal information handled in the course of carrying on an enterprise, and the CAI treats an identifiable person’s image on a recording as personal information.
Do I need a privacy impact assessment for security cameras?
Section 3.3 requires one for projects to acquire, develop or overhaul an information system involving personal information, and the CAI recommends an assessment for video surveillance. Whether a particular setup counts is a legal question, so doing and documenting an assessment before you install is the safe choice.
Do I have to name a privacy officer?
You must have a person in charge of protecting personal information. By default it is the person with the highest authority in the business, who may delegate the role in writing, and their title and contact details must be published on your website.
How long can I keep security camera footage in Quebec?
The Act does not set a number. The CAI’s guide says 30 days is generally sufficient and recommended, and that recordings should be destroyed securely as soon as they are no longer needed. Keep clips about a specific incident for as long as the incident requires.
Can my camera record sound?
It can technically, but audio is far more intrusive than video, and recording private conversations can break the Criminal Code. Keep audio off unless you have a documented need and legal advice.
What are the penalties for getting it wrong?
The CAI can impose administrative penalties of up to $10 million or 2% of worldwide turnover. Penal fines for a business range from $15,000 up to $25 million or 4% of worldwide turnover, and double for a repeat offence.
This guide is general information based on the Act respecting the protection of personal information in the private sector and the CAI’s published guidance as of October 2026. It is not legal advice, so ask a Quebec lawyer about your specific setup.
Ready to book? Planning a business camera system? Pixl gives a free walkthrough and a written quote, and you pay after the job. Quebec has its own installer rules, so check that we serve your area before booking.
Written by the Pixl Canada install team: licensed technicians with $5 million liability insurance, installing TVs, security cameras, smart home devices and appliances across Canada.
Keep reading
Cameras at work: employee privacy
Rules for employers
Do you need a security camera sign?
Notice and wording
Landlord and tenant camera rules
What each side can do