Law 25 for a Québec small business: the 6 obligations and where to start
Law 25 (S.Q. 2021, c. 25) modernized the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). It came into force in three waves: September 2022, September 2023 and September 2024. Since then, it applies to any business that collects, uses or keeps personal information in Québec, with no threshold for size or revenue. A freelancer who keeps a client list with email addresses is covered just as much as a large company. Here are the six obligations that come up in almost every compliance clean-up for a small business.
1. Designate a person in charge of the protection of personal information
By default, this is the person with the highest authority in the business: you, if you are a freelancer or the sole manager. The role can be delegated in writing to someone else. What is mandatory: publishing the title and contact details of the person in charge on your website (or, if you have no website, making them available by other means). One line in the privacy policy is enough, as long as it is kept up to date.
2. Keep a register of confidentiality incidents
An incident is any unauthorized access to, use or communication of personal information, or its loss: a misplaced laptop, an email sent to the wrong client with an invoice attached, a cloud account viewed by a former employee. Every incident must be recorded in a register, even a minor one. If the incident presents a risk of serious injury, you must also notify the Commission d’accès à l’information (CAI) and the people concerned. The register is kept for at least five years after the date you became aware of the incident.
3. Publish a privacy policy in plain language
Since September 2023, any business that collects personal information by technological means (web form, online store, newsletter) must publish a policy written “in clear and simple terms”. At a minimum, it states: what information is collected and why, who has access to it, where it is hosted, how long it is kept, what rights people have (access, correction, withdrawal of consent, portability) and how to reach the person in charge. A text copied from an American website, which talks about “California residents” and does not mention the CAI, does not comply.
4. Obtain valid consent and set the defaults
Consent must be manifest, free and enlightened, and given for specific purposes. In practice: a separate checkbox for the newsletter (never pre-checked), a purpose explained in one sentence, and express consent for any sensitive information (health, financial situation, biometric data). Cookies and tools that make it possible to identify, locate or profile a person must be turned off by default, and the person must be informed of them.
5. Carry out a privacy impact assessment (PIA)
Two situations require a PIA: any project to acquire or overhaul an information system that involves personal information (switching invoicing software, adopting a CRM), and any communication of information outside Québec (a supplier hosted in the United States, for example). For a small business, the PIA is proportionate to the project: a two- or three-page document describing the data, the risks and the measures chosen is often enough. What matters is that it exists and that it is dated.
6. Respect people’s rights, including portability
Anyone can ask for access to their information, for its correction or for the withdrawal of their consent, and, since September 2024, can obtain a copy of their information in a structured, commonly used technological format (the right to portability). You have 30 days to respond. Plan ahead how you will export a client’s data from your tools: it is much easier to do once, with a clear head, than under pressure.
Where to start?
In this order: designate the person in charge and publish their contact details, write the privacy policy, open the incident register (even if it stays empty), then list your suppliers and the country where each one hosts your data. These four tasks cover most of what a client or the CAI may ask of you. The PIA comes next, the next time you change tools.
The Trousse de conformité Loi 25 (Law 25 compliance kit) contains the 30-question self-assessment, the letter designating the person in charge, the privacy policy generator, the incident register with templates for notices to the CAI, the supplier register and the PIA template. Your data stays on your computer. $39 CAD, paid once. Amounts before taxes.
See the Trousse Loi 25: $39 CAD