In short
“Law 25” is the common name for the Québec law adopted in 2021 to modernize the protection of personal information. Among other things, it amended the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). Its obligations came into force in three stages: September 2022, September 2023 and September 2024.
For a website, the starting question is simple: does your site collect personal information? A name, an email address or a phone number typed into a contact form all count. If the answer is yes, this checklist applies to you.
This guide is a checking tool, not legal advice. For a specific situation, consult a lawyer or Québec’s Commission d’accès à l’information.
Who does it apply to?
The law applies to anyone carrying on an enterprise in Québec who collects, holds, uses or communicates personal information. There is no size threshold: a self-employed worker with a contact form is covered, just like a hundred-employee company.
What the site must display
Three things must be publicly visible, on the website itself.
- AFF-01A person in charge of the protection of personal information is designatedBy default, this is the person with the highest authority in the business; the role can be delegated in writing. Their title and contact information are published on the website (s. 3.1).
- AFF-02A privacy policy is published on the websiteRequired when information is collected through technological means, such as a form. Written in clear and simple terms (s. 8.2). A visible link in the footer and next to every form is good practice.
- AFF-03The policy says what, why, how, and what your rights areInformation collected, purposes, means of collection, rights of access and rectification, right to withdraw consent, contact details of the person in charge, possible communication outside Québec, retention period.
- AFF-04Governance rules are summarized on the websiteThe business adopts policies and practices governing personal information (retention, destruction, roles, complaint handling) and publishes detailed information about them, in clear and simple terms, on its website (s. 3.2).
What the site must ask, and how
Forms, cookies and tools embedded in the site are where the law shows the most.
- DEM-01Every form explains why it collects the informationAt the time of collection, the person is told the purposes, the means, their rights of access and rectification and their right to withdraw consent (s. 8).
- DEM-02Only necessary information is requestedOnly what is necessary for the purposes determined before collection is collected (s. 5). A contact form usually doesn’t need a mailing address or a date of birth.
- DEM-03Consent is clear, free, informed and given for specific purposesRequested for each purpose in clear and simple terms and, in writing, presented separately from any other information (s. 14). According to the Commission’s guidance, a pre-ticked box or consent buried in the terms of use does not meet these criteria.
- DEM-04The newsletter has its own checkboxAnswering a request and sending marketing are two separate purposes: commercial prospecting cannot be considered a consistent purpose (s. 12). Two purposes, two consents. (Commercial messages are also governed by Canada’s anti-spam legislation.)
- DEM-05Functions that identify, locate or profile are disclosed and activated by the visitorIf the site uses technology that can identify, locate or profile a visitor (some advertising or analytics tools), it must inform them beforehand, along with the means to activate those functions (s. 8.1).
- DEM-06Third parties and communication outside Québec are disclosedWhere applicable, state the name of the third parties or categories of third parties the information is shared with (form tool, newsletter, host) and the possibility that it is communicated outside Québec (s. 8).
What the business must manage behind the scenes
These obligations aren’t visible on the site, but they flow from it: what you do with the messages you receive and the tools you use.
- GER-01A register of confidentiality incidents is keptEvery incident is recorded (s. 3.8). If it presents a risk of serious injury, the Commission d’accès à l’information and the people concerned are notified promptly (s. 3.5).
- GER-02An assessment is done before sending information outside QuébecBefore communicating information outside Québec, for example to a host or cloud tool located elsewhere, a privacy impact assessment is carried out (s. 17).
- GER-03A retention period is set, then data is destroyedOnce the purpose is achieved, the information is destroyed or anonymized, subject to retention periods required by law (s. 23). Think of form messages piling up in an inbox.
- GER-04Access, rectification and portability requests have a procedureThe person in charge responds in writing within 30 days of receipt (s. 32). Since September 2024, a person can also request their information in a structured, commonly used technological format (s. 27).
- GER-05Providers that handle information have a written agreementEntrusting information to a provider (host, email tool, developer) requires a written contract specifying the protective measures (s. 18.3).
- GER-06Reasonable security measures protect the dataHTTPS site, access to messages limited to those who need it, strong passwords, updates applied: measures suited to the sensitivity of the information (s. 10).
Printable version
The 16 items above are gathered on a single page, ready to print and tick off: printable Law 25 checklist. To quickly see whether your site links to a privacy policy, try our free site check.
What a business risks
For a business that is not a natural person, the Commission d’accès à l’information can impose monetary administrative penalties of up to $10 million or 2% of the previous year’s worldwide turnover, whichever is greater (s. 90.12). Penal fines can reach $25 million or 4% of worldwide turnover (s. 91). These are maximums: in practice, the first step is often to fix things. But a form without a privacy policy remains one of the easiest gaps to spot.
Sources
- Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 — LégisQuébec
- Commission d’accès à l’information du Québec — cai.gouv.qc.ca
Frequently asked questions
Q.01Is my three-person business covered?
Yes. The law has no size threshold: any business that collects personal information is covered.
Q.02My site only has a contact form. Do I need a privacy policy?
Yes. A name and an email address are personal information, and collecting them through a form is collection by technological means: the policy must be published on the site.
Q.03Who should be the person in charge of personal information?
By default, the person with the highest authority in the business, often the owner. They can delegate the role in writing. Their title and contact information must be published on the site.
Q.04Do I need a cookie banner?
It depends on the tools used. If a tool can identify, locate or profile visitors, you must first inform them and tell them how to activate those functions (s. 8.1). A site that uses no such tool doesn’t have this obligation.