Quebec's Commission d'accès à l'information received 514 confidentiality incident notices in the 2024-25 fiscal year, up 16% on the 444 of 2023-24 and 559% above the 78 voluntary notices of 2021-22, according to its Rapport annuel d'activités et de gestion 2024-2025. Since Law 25 made reporting mandatory in September 2022, private businesses have supplied about four in five of them.
How many breach notices does Quebec's regulator receive?
In 2024-25 the Commission received 514 notices of confidentiality incidents, and it processed 736, which it reports as 108% more than the year before. The 2023-24 report gives 444 received and 353 processed, so in 2024-25 it closed out more notices than it received.
| Fiscal year | Notices received | Change |
|---|---|---|
| 2021-22 (voluntary reporting) | 78 | Baseline |
| 2023-24 | 444 | 469% above 2021-22 |
| 2024-25 | 514 | 16% above 2023-24 |
Source: Commission d'accès à l'information, annual reports 2023-2024 and 2024-2025. The 2022-23 count is not used here because it was not in the two reports we read.
The Commission says reporting became compulsory on 22 September 2022. Before that, an organization could choose to tell it about an incident. The 2023-24 report links the 469% jump to that switch and calls it similar to what other Canadian jurisdictions saw after comparable changes.
Figure 1: Confidentiality incident notices received by the Commission, 2021-22, 2023-24 and 2024-25. Source: Commission d'accès à l'information, annual reports 2023-2024 and 2024-2025.
The notice count has risen almost sevenfold since reporting became a duty.
Who reports the most incidents?
In 2024-25, 80% of the 514 notices came from the private sector, 16% from the public sector and 4% from health and social services. The year before, the split was 81% private and 19% public, so the private share has barely moved while the volume grew.
Figure 2: Share of 2024-25 incident notices by sector. Source: Commission d'accès à l'information, Rapport annuel 2024-2025.
By industry, the Commission's chart puts health care and social assistance first with 94 notices, ahead of finance and insurance (89), professional, scientific and technical services (61), educational services (37) and retail trade (36). Public administration accounts for 30.
If you run a small online business with customers in Quebec, you sit in the group that files most of these notices. For the federal picture across Canada, see our figures on PIPEDA breach reports.
Four of every five notices come from businesses and not from government bodies.
What causes the incidents?
The most common causes named in 2024-25 notices were cyberattacks (160), human error (110) and ransomware (106). Accidental communication of information was named 100 times and theft of information 96 times. A single notice can list more than one cause, so these counts add up to more than 514.
Figure 3: The seven most common causes named in 2024-25 notices, including notices with several causes. Source: Commission d'accès à l'information, Rapport annuel 2024-2025, chart "Répartition des avis d'incidents reçus, par cause".
The pattern held from 2023-24, when cyberattacks (154), ransomware (98) and human error (61) led the list. Human error is the category that grew most, from 61 to 110 mentions. By type, 251 of the 514 notices involved unauthorized access to personal information, 116 unauthorized communication, 59 loss or another breach of protection and 9 unauthorized use. Another 79 notices (15%) fit more than one category.
Human error mentions rose from 61 to 110 in a year, the largest jump of any cause on the Commission's chart.
How does the Commission turn a notice or complaint into enforcement?
A complaint or a notice goes through analysis. The Commission can then run an administrative or a penal investigation, issue a compliance reminder, or inspect. An administrative investigation can end in an order, a recommendation or a monetary penalty. A penal investigation can end in charges. A business can also give the Commission an undertaking, and if the Commission approves it and the business keeps it, no monetary penalty follows for the facts covered.
Figure 4: Oversight path described in the Commission's 2024-2025 annual report. This summarizes the regulator's own diagram and is not legal advice.
Complaint volume is climbing too. The Commission received 549 oversight complaints in 2024-25, against 277 in 2023-24, a 98% rise, and treated 321. It reports a 227% increase in complaints since 2021-22. In the same year it received 104 biometric disclosures, down from 124.
The Commission's 2024-25 report counts notices and complaints, but we found no count of monetary penalties imposed in it, so we do not give one.
What are the penalties under Law 25?
The Commission states that administrative monetary penalties on businesses can reach 2% of worldwide turnover or $10 million. Penal fines for a business run from $15,000 up to the higher of $25 million or 4% of the previous fiscal year's worldwide turnover, and fines double for a repeat offense. For an individual, penal fines run from $5,000 to $100,000. All amounts are Canadian dollars.
Failing to report a confidentiality incident that presents a risk of serious injury is one of the listed breaches that can draw an administrative penalty. So are failing to inform people about collection of their data and failing to take security measures suited to the information. The Commission has been able to impose these penalties since 22 September 2023, and it can bring a penal case within five years.
Figure 5: Milestones in Quebec's incident reporting regime. Source: Commission d'accès à l'information, annual reports 2023-2024 and 2024-2025, and its sanctions page.
The ceilings are set high, and the Commission publishes a framework that explains how it decides whether to impose a penalty and how much.
The Bottom Line
Quebec's regulator received 514 incident notices in 2024-25, up 16% in a year and 559% since reporting was voluntary. Four in five came from private businesses, and the leading causes were cyberattacks, human error and ransomware. Complaints are growing even faster, and the penalty ceilings reach $10 million for administrative penalties and $25 million or 4% of worldwide turnover for penal fines. If you collect personal information about people in Quebec, decide in advance who judges whether an incident risks serious injury, who contacts the Commission, and how you tell the people affected. A clear privacy policy that explains how you collect, use and protect data helps you meet the transparency side of the law, but it does not replace an incident process. This article is general information, not legal advice.
Frequently Asked Questions
How many breach notices did Quebec's privacy regulator receive in 2024-25? The Commission d'accès à l'information received 514 confidentiality incident notices in the 2024-25 fiscal year, up 16% from 444 in 2023-24 and up 559% from the 78 voluntary notices of 2021-22.
What are the maximum penalties under Quebec's Law 25? The Commission says an administrative monetary penalty can reach 2% of worldwide turnover or C$10 million. A penal fine for a business runs from C$15,000 up to the higher of C$25 million or 4% of the prior year's worldwide turnover.
Do businesses have to report breaches to Quebec's regulator? Yes. Since 22 September 2022, an organization must notify the Commission of any confidentiality incident that presents a risk of serious injury to the people concerned. Before that date, notice was voluntary, and only 78 notices arrived in 2021-22.
What causes most reported incidents in Quebec? Cyberattacks, named in 160 of the 514 notices in 2024-25, followed by human error (110) and ransomware (106). One notice can name several causes, so the counts overlap.
Where the Numbers Come From
- Commission d'accès à l'information: Rapport annuel d'activités et de gestion 2024-2025. 514 notices, 736 processed, 559% three-year rise, sector split, causes and types, 549 complaints, 104 biometric disclosures, the oversight diagram. Published in French; translations here are ours.
- Commission d'accès à l'information: Rapport annuel d'activités et de gestion 2023-2024. 444 notices, 78 notices in 2021-22, mandatory reporting from 22 September 2022, monetary penalties from 22 September 2023, 277 complaints.
- Commission d'accès à l'information: Sanctions (private-sector businesses). The 2% or $10 million administrative ceiling, the penal fine ranges, the list of breaches, undertakings and the five-year limit for penal cases.
Note: All figures verified as of November 2026 against the Commission's 2024-25 and 2023-24 annual reports and its sanctions page. The Commission publishes a new annual report each year, so check for 2025-26 figures when they appear.
