Law 25 and PIPEDA Guide for Canadian Non-Profits

The short answer: which law applies

Non-profit status does not take you outside privacy law. Which law applies depends on where you operate and what you do with personal information.

Québec

Law 25

Québec's private-sector privacy Act, as amended by Law 25, applies to any "enterprise": an organized economic activity, whether or not it is commercial. Most non-profits that run programs or deliver services are covered.

Federal

PIPEDA

Applies to charities only for commercial activities. Selling, bartering or leasing a donor or membership list is commercial; fundraising, membership fees and newsletters are not.

Other provinces

Provincial laws

Some provinces have their own private-sector laws. British Columbia's PIPA expressly covers not-for-profit organizations. Check the law where you operate.

Even where no privacy law strictly applies, the Privacy Commissioner of Canada suggests following PIPEDA's fair information principles as best practice. Your donors and clients expect it either way. This guide is general information, not legal advice; for Québec questions in particular, a privacy lawyer can confirm how the Act applies to you.

Source 1 · Québec

What Law 25 requires of a non-profit

Law 25 modernized Québec's Act respecting the protection of personal information in the private sector. Its changes came into force in stages between September 2022 and September 2024, and the Commission d'accès à l'information (CAI) enforces it. These are the obligations a non-profit meets most often, with the section of the Act:

Obligation	What the Act requires	Section
A person in charge of privacy	The person with the highest authority in the organization is responsible for making sure the Act is applied, and is the person in charge of the protection of personal information by default. The role can be delegated, in writing, to anyone. The person's title and contact information must be published on your website.	s. 3.1
Published governance policies	Written policies and practices that cover keeping and destroying personal information, staff roles throughout its life cycle, and how privacy complaints are handled. They must be proportionate to your activities, approved by the person in charge, and described in simple, clear language on your website.	s. 3.2
Telling people what you collect, and why	When you collect personal information, tell people the purposes, how you collect it, their rights of access and correction, and their right to withdraw consent, plus who else receives it and whether it may leave Québec. If you use technology that can identify, locate or profile someone, tell them first.	ss. 8, 8.1
Valid consent	Consent must be clear, free and informed, given for specific purposes, and requested for each purpose in clear, simple language. Sensitive information needs express consent. For children under 14, a parent or tutor consents.	ss. 12, 14, 4.1
Fundraising rules	Using information for "philanthropic prospection" (fundraising outreach) is never a purpose "consistent" with why you collected it, so it needs consent. When you use personal information for fundraising, you must identify yourself and tell the person they can withdraw consent; if they do, you must stop.	ss. 12, 22
Security measures	Reasonable security measures, given how sensitive the information is, what it is used for, how much there is, where it is spread and what it is stored on.	s. 10
Privacy impact assessments	Required before acquiring, developing or overhauling an information system that handles personal information (a new donor CRM, for example), and before communicating personal information outside Québec, including when a provider outside Québec stores or processes it for you. Transfers outside Québec also need a written agreement.	ss. 3.3, 17
Contracts with service providers	When a provider handles personal information for you, the mandate or contract must be in writing and spell out how the provider protects it, uses it only for your work, and does not keep it afterwards. The provider must tell your person in charge of any breach or attempted breach without delay.	s. 18.3
Confidentiality incidents	An incident is unauthorized access, use or communication, or loss of personal information. Take reasonable steps to reduce the risk. If there is a risk of serious injury, promptly notify the Commission d'accès à l'information and the people affected. Keep a register of every incident, serious or not, for at least five years.	ss. 3.5–3.8; Regulation ss. 3, 7, 8
Access requests	The person in charge must answer access and correction requests in writing within 30 days. No answer within 30 days counts as a refusal.	s. 32
Retention and destruction	When the purposes are achieved, destroy the information, or anonymize it only under the Act's conditions, subject to any retention period required by law.	s. 23

Penalties

For organizations, administrative monetary penalties can reach $10,000,000 or 2% of worldwide turnover, whichever is greater (s. 90.12), and penal fines range from $15,000 to $25,000,000 or 4% of worldwide turnover (s. 91). Failing to report a confidentiality incident when required is one of the listed offences.

Source 2 · Federal

When PIPEDA applies to a charity

The Office of the Privacy Commissioner of Canada (OPC) is direct: non-profit status does not automatically exempt an organization from PIPEDA. Most charities fall outside it most of the time, because fundraising, collecting membership fees, organizing activities, compiling a member list and mailing newsletters are not commercial activities. Selling, bartering or leasing a donor or membership list is.

Donor list trading needs opt-in consent

In PIPEDA Findings #2021-009, a charity shared donors' contact details with other charities through a list-trading program, relying on an opt-out checkbox on its donation forms. The OPC found that sharing was outside donors' reasonable expectations, so express opt-in consent was required, and that the form did not clearly say what would be shared, with whom or why. The charity agreed to the OPC's recommendations and later left the program.

If PIPEDA applies: breach reporting

Report a breach to the OPC, as soon as feasible, when it is reasonable to believe it creates a real risk of significant harm.
Notify the people affected, and any organization that can help reduce the harm.
Record every breach, reported or not, and keep the record for 24 months.

ABISOL practice

Where non-profits usually get stuck

Donor and email tools hosted outside Québec, with no assessment. The CRM, donation platform or newsletter tool was chosen years ago; Law 25 now expects a privacy impact assessment and a written agreement for that transfer.
Volunteers using personal email and devices. Donor and client information ends up in places the organization cannot secure, review or delete.
A privacy officer in name only. Someone was named in 2022, but the website does not show the contact, and no one owns the incident register.
Consent wording that predates Law 25. One checkbox for everything, buried in other text, with no clear way to withdraw from fundraising.
No incident register. A lost laptop or a misdirected email is an incident that must be recorded, even when it does not need to be reported.

ABISOL helps non-profits put this in place in proportion to their size: the policies, the register, the assessments for your existing tools, and the security behind them. See how ABISOL works with non-profits and charities, or our guide to the controls cyber insurers ask about.

Questions non-profits ask

Does Law 25 apply to our charity or non-profit?

Very likely, if you operate in Québec. The Act applies to personal information handled in the course of carrying on an "enterprise", which the Civil Code defines as an organized economic activity, whether or not it is commercial, such as providing a service. Most non-profits that run programs, employ staff or deliver services meet that description. If your situation is unusual, ask a Québec privacy lawyer.

We are based outside Québec but have donors there. Does Law 25 apply to us?

The Act's text does not give a simple test for organizations based outside Québec. If you actively collect information from people in Québec, get legal advice. Meeting Law 25's main requirements is also good practice under other Canadian privacy laws.

Does PIPEDA apply to charities?

Only to commercial activities. The Privacy Commissioner says non-profit status does not automatically exempt an organization, and that selling, bartering or leasing a donor or membership list is a commercial activity. Fundraising, collecting membership fees, organizing activities and mailing newsletters are not. Even where PIPEDA does not apply, the Commissioner suggests following its fair information principles as best practice.

Can we swap or rent donor lists with other charities?

Only with express opt-in consent. In PIPEDA Findings #2021-009, the Privacy Commissioner found that a charity's opt-out checkbox was not meaningful consent for sharing donor contact details with other charities, because donors would not reasonably expect it. In Québec, fundraising use also needs consent and a clear way to withdraw it.

Can we use a donor database or email platform hosted in the United States?

Yes, but under Law 25 you must first do a privacy impact assessment that considers the sensitivity of the information, the purposes, the protection measures and the legal framework where it will be held, and the transfer must be covered by a written agreement. Assess this before you sign or migrate, not after.

Who should be our person in charge of privacy?

By default, the person with the highest authority in the organization. They can delegate the role in writing, for example to an operations or privacy lead, but they remain responsible for making sure the Act is applied. Publish the role's title and contact information on your website.

Sources

Read on October 8, 2026. If a source has changed since, the source wins.

Privacy law for non-profits: Law 25, PIPEDA and what applies to you