Quebec's Law 25: what your website has to do

Who it covers

Law 25 is the common name for the 2021 amendments to Quebec's Act respecting the protection of personal information in the private sector. It applies to any enterprise that collects, holds, uses or shares personal information about people in Quebec, and it does not care where the enterprise sits. An Ontario store that ships to Quebec customers and keeps their names, addresses and email is in scope for that information.

There is no employee threshold and no revenue threshold. A two-person business with a checkout is covered in the same way a bank is, which is the main difference from Ontario's AODA rules, where the website obligations start at 50 employees.

The three deadlines

The obligations arrived in three waves. From September 22, 2022: every enterprise needs a person in charge of personal information, which is the person with the highest authority unless they delegate it in writing, with their title and contact details published on the website. Confidentiality incidents that present a risk of serious injury have to be reported to the Commission d'accès à l'information and to the people affected, and logged in a register.

From September 22, 2023, the bulk of it: a privacy policy in clear and simple language published on the website, consent that is clear, free, informed and requested separately for each purpose, privacy impact assessments before any project that involves personal information and before sending it outside Quebec, disclosure of any technology that identifies, locates or profiles a visitor along with the means to activate it, and the right to know when a decision about you was made entirely by automated processing.

From September 22, 2024: the right to data portability, meaning a person can ask for their computerized personal information in a structured, commonly used format.

What it means for the site itself

In practice a compliant website needs five things. A privacy policy page written for people rather than lawyers, with a notice when it changes. The privacy officer's title and contact on that page. A consent mechanism that separates purposes, so the newsletter checkbox is not pre-ticked and is not bundled with the order. Tracking that profiles the visitor, which includes most advertising pixels and some analytics, disabled until the visitor activates it, with a plain statement that it exists. Forms that collect only what the purpose needs.

The quieter obligation is the assessment for data that leaves Quebec. Almost every small business sends personal information to tools hosted in the United States: email platforms, analytics, hosting, support desks. The law does not ban that; it requires a documented assessment that the information will be adequately protected, which is a page of writing per system rather than a migration.

The penalties, and the realistic risk

The Commission can impose administrative monetary penalties of up to $10 million or 2 percent of worldwide turnover for the previous year, whichever is greater. Penal fines on prosecution go up to $25 million or 4 percent of worldwide turnover, doubled for a repeat offence. A person harmed by an intentional or grossly negligent breach can also sue, with punitive damages of at least $1,000.

Those ceilings exist for large organizations. The realistic exposure for a small business is a complaint to the Commission, a breach that has to be reported with no incident register to report from, or a larger customer's vendor questionnaire that the business cannot answer. All three are cheaper to prevent than to survive.

Doing it without wrecking the site

Start with an inventory: every form, every tag, every tool that receives a visitor's data, and where that tool is hosted. That list is the privacy policy's raw material and the assessment's scope. Then wire the consent layer so the site works properly with tracking off, which usually means first-party analytics for the basics and advertising tags that load only after a choice. A banner with a single accept button does not meet the standard and is the most common thing we are asked to replace.

We build the mechanics: the consent layer, the forms, the tag loading, the data flows. A privacy lawyer signs off the policy and the assessments. This guide is a summary of the statute, not legal advice, and the law is the final word.