Loi 25 (Quebec privacy law)

Also known as: Quebec privacy modernization act · Loi 64 · Quebec GDPR

Loi 25 (formerly Loi 64) modernizes Quebec's personal information protection framework. Phased in between 2022 and 2024, it places strict obligations on every business operating in Quebec — including STR operators and booking platforms: appoint a Privacy Officer, keep an incident register, obtain explicit consent, and inform every person whose data is collected.

For an STR operator, the main impacts are: (1) publish a clear privacy policy, (2) get explicit consent before sharing guest contact info with a third party (cleaner, locksmith), (3) notify any privacy incident to the CAI (Commission d'accès à l'information) within 72 hours if it poses a serious risk.

Reserver.ca operates its own infrastructure (Postgres + Postmark + Cloudflare) and never sends guest data to non-compliant external CRMs. The public privacy policy is reviewed quarterly.

Non-compliance fines are substantial: up to CA$25M or 4% of worldwide revenue, on par with European GDPR.

Sources

Commission d'accès à l'information — Loi 25 overview (FR)