Law 25 — what your website needs

Law 25 applies to every enterprise that collects personal information in Québec. There is no size threshold (s. 1). A contact form is enough: a name and an email address are personal information.

This guide covers what reaches your website, with the section of the Act for each point. It is not legal advice. References are to the Act respecting the protection of personal information in the private sector, read in its version current to 10 June 2026.

The seven points that reach a website

1. A named person in charge, shown on the site

By default, the person with the highest authority in the enterprise is responsible for protecting personal information. They can delegate the role in writing. Either way, their title and contact information must be published on the website (s. 3.1).

For a three-person business, that is one line in the privacy policy: a title, an email address.

2. A privacy policy in plain language

As soon as you collect information through technological means, you must publish a confidentiality policy on your website "in clear and simple language", and give notice when it changes (s. 8.2).

A text copied from an American generator that talks about the GDPR and California does not answer the question. The policy has to describe what your site collects.

3. A notice at the moment of collection

When you collect information, you must say what it will be used for, by what means it is collected, and that the person can access it, have it corrected, and withdraw consent. If the information may leave Québec, you must say that too (s. 8).

A person who provides their information after receiving that notice consents to the stated purposes (s. 8.3). In practice: one sentence under your form, with a link to the policy.

4. Technology that identifies, locates, or profiles

If your site uses technology that can identify a person, locate them, or profile them, you must inform them first, and tell them how to activate those functions (s. 8.1). The Commission d'accès à l'information draws the practical rule from this: those functions are off by default, and the visitor turns them on.

The Commission's own example is profiling cookies: a notice on the first visit, and nothing active until the visitor chooses it. An advertising pixel does the same job. For other tools (analytics, embedded maps, videos), the Act does not name them: it depends on what the tool actually does with the data. Analytics that follow nobody from site to site do not raise the same question as a tool that builds an advertising profile.

5. Tools hosted outside Québec

Before communicating personal information outside Québec, you must carry out a privacy impact assessment and frame the communication with a written agreement. That also applies when you entrust a provider outside Québec with collecting or keeping the information (s. 17). The assessment is proportionate to the sensitivity and quantity of the information (s. 3.3).

On a website, that covers the services behind the form, the newsletter, the booking tool, and the analytics. The first step is simple: list those services and where each one keeps its data.

6. An incident register

If a confidentiality incident presents a risk of serious injury, you must promptly notify the Commission and the people concerned (s. 3.5). You must keep a register of every incident, including the ones you do not report (s. 3.8).

7. Portability

Since 22 September 2024, a person can ask that the computerized information they gave you be handed back in a structured, commonly used technological format (s. 27). If your contact requests sit in an inbox, you need to be able to find them.

The penalties

• Administrative penalties: up to $10 million or 2% of worldwide turnover (s. 90.12).
• Penal fines: from $15,000 to $25 million or 4% of worldwide turnover (s. 91), doubled on a subsequent offence (s. 92.1).

Those ceilings are aimed at large companies. For a small business the real risk is more ordinary: a complaint from a customer, and nothing to show in response.

What the law does not say

Three claims come up often, and none of them is in the text.

• "Small businesses are exempt." No. The Act covers every enterprise, with no threshold.
• "You need a cookie banner for everything." The Act does not say so. The "highest level of confidentiality by default" rule expressly excludes browser cookie settings (s. 9.1). What requires the visitor to opt in is technology that identifies, locates, or profiles.
• "The site must be hosted in Canada." Not that either. The Act requires an assessment and an agreement before information leaves Québec. It does not forbid it from leaving.

Checklist

• The title and contact information of the person in charge are on the site
• The privacy policy describes what this site collects, in everyday language
• Every form carries a notice: what the information is for, and a link to the policy
• No profiling tool activates before the visitor has chosen it
• A list of third-party services exists, with where each one keeps its data
• The assessment is done for the ones that keep data outside Québec
• An incident register exists, even if it is empty
• You know how to pull out one person's information when they ask for it

Sources

• Act respecting the protection of personal information in the private sector (P-39.1), LégisQuébec
• Main changes brought by Law 25, Commission d'accès à l'information (in French)
• Guidelines on the criteria for valid consent, Commission d'accès à l'information (in French)

A new site is the right moment to settle these points, because that is when the tools get chosen. A review of your current site is free.