Employee monitoring law · Quebec
Law 25 adds privacy by default, impact assessments and a right to explanation.
Run the impact assessment, default to the most private setting, and explain automated decisions.
- Region
- North America
- Instruments
- 2 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
Quebec · what the law requires
Notice and proportionality
Quebec's Law 25 substantially rewrote the private-sector privacy act. Relevant here: privacy by default, a privacy impact assessment for any project acquiring or developing an information system involving personal information, mandatory incident reporting, and, distinctively, a right to be informed and to make representations when a decision is based exclusively on automated processing. The Civil Code's right to privacy applies alongside.
- A privacy impact assessmentRequired for any project to acquire, develop or overhaul an information system involving personal information. Deploying monitoring software qualifies.
- Automated decision transparencyWhere a decision is based exclusively on automated processing, the person must be told, and be able to submit observations to a human.
- Privacy by defaultThe highest privacy settings apply without any action by the individual.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- Act respecting the protection of personal information in the private sector: as amended by Law 25 (formerly Bill 64). Privacy by default, mandatory PIAs for information system projects, incident reporting, and automated decision transparency.
- Civil Code of Québec: arts. 35–41. The general right to respect for private life, which Quebec courts apply directly to workplace surveillance.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in Quebec that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Complete the PIA before acquiring or deploying the system.
- 2Appoint the privacy officer Law 25 requires and publish the contact.
- 3Make sure no employment decision rests exclusively on automated processing.
- If you get it wrongAdministrative monetary penalties up to CAD $10m or 2% of worldwide turnover; penal fines up to CAD $25m or 4%. Private right of action with punitive damages of at least CAD $1,000.
Verify the claim
Every control above, on the page that describes it
- Explainability view behind every number plus an appeal routeNever let a score be the sole basis of a decision
- Screenshot capture off by default and per-app deny-lists applied on the deviceStart from the most private configuration
- Published control inventory with source referencesSupport the PIA with a documented data flow
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in North America
- United States (federal)Federal law is permissive; the real constraints are state law and the NLRA.
- New YorkWritten notice on hire, signed acknowledgement, and a posted notice, all three.
- CaliforniaEmployees have full CCPA rights since 2023, including deletion and correction.
- IllinoisBIPA carries a private right of action. This is the state where monitoring gets sued.
- Canada (federal)Reasonableness is the statutory test, and the OPC applies a four-part necessity analysis.
- OntarioA written electronic monitoring policy is mandatory at 25+ employees, refreshed annually.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.