Quebec Law 25: obligations and good practices for small businesses

A business holding personal information about customers, employees or applicants must assess its privacy obligations. Changes associated with Law 25 affect governance, transparency, consent and information systems. Installing antivirus software or a cookie banner does not establish compliance.

Provisions took effect progressively, notably on September 22 in 2022, 2023 and 2024. In 2026, businesses should therefore assess applicable obligations rather than treat Law 25 as a future deadline. This guide offers private-sector pointers, not legal advice or a compliance certification. The law and Commission d’accès à l’information (CAI) guidance remain the authorities.

The person with the highest authority in a business is responsible for personal information by default. Duties may be delegated, in whole or in part, in writing. The officer’s title and contact information must be published on the business website or, without a website, made public through another appropriate means. Document the actual designation rather than inventing an identity.

Establish governance policies and practices covering responsibilities, retention and destruction, complaints and information access. Publish required information in plain language. An inventory of systems, files and suppliers helps connect written rules to actual business practices.

Before requesting information, determine why it is necessary. Consent does not justify unnecessary collection. Explain the purposes of forms, minimize fields and avoid asking for secrets or sensitive information when it is not needed.

Where consent is required, its legal criteria must be satisfied: it must notably be manifest, free, informed and given for specific purposes. Requirements vary by context, especially for sensitive information. One checkbox does not cover every use; distinguish handling an enquiry from a marketing subscription.

An incident may involve unauthorized access, use or disclosure, lost information or another breach of protection. Take reasonable steps to reduce harm and prevent recurrence. Maintain an incident register, including incidents that do not trigger notification.

If an incident poses a risk of serious injury, the business must notify the CAI and affected individuals with diligence. This guide does not replace that requirement with a general 72-hour rule. Establish contacts, evidence preservation, risk assessment and communication steps before an incident occurs.

A privacy impact assessment (PIA, or EFVP in French) is required in specified situations, including projects to acquire, develop or redesign information systems or electronic services involving personal information. Consult the privacy officer at the beginning of the project, rather than treating assessment as a launch-day formality.

Before communicating personal information outside Quebec, a PIA must also assess its protection. The CAI specifies that a written agreement is required and communication may proceed only where adequate protection is ensured. Cloud selection should consider processing locations, access and contractual terms, not just a country named on a sales page.

Technical measures should be appropriate to the information’s sensitivity, purpose, quantity and context. SolutionsCW can help implement protections and systems; legal interpretation and governance decisions must be validated with qualified people. Microsoft 365, a firewall or hosting does not automatically make a business compliant.