If you stay non-compliant
$10K–$100K in fines
Per Law 25 violation — the CAI does not send friendly reminders first.
Legal action
Class actions from customers or enforcement by Québec's regulator.
Data breaches
Unprotected personal information is an open door — and your liability.