Law 25: what your website needs

A contact form that asks for a name and an email address is enough. Both are personal information, and Law 25 applies to every enterprise that collects personal information in Québec, with no size threshold (s. 1).

Below are the seven obligations that reach a website, each with its section of the Act, then a checklist. This is not legal advice. References are to the Act respecting the protection of personal information in the private sector, read in its version current to 10 June 2026.

The seven points that reach a website

1. A named person in charge, shown on the site

By default, the person with the highest authority in the enterprise is responsible for protecting personal information. They can delegate the role in writing. Either way, their title and contact information must be published on the website (s. 3.1).

For a three-person business, that is one line in the privacy policy: a title and an email address.

2. A privacy policy in plain language

As soon as you collect information through technological means, you must publish a confidentiality policy on your website "in clear and simple language", and give notice when it changes (s. 8.2).

A text copied from an American generator that talks about the GDPR and California describes someone else's obligations. The policy has to say what your site collects.

3. A notice at the moment of collection

When you collect information, you must say what it will be used for and by what means it is collected. You must also say that the person can access it, have it corrected, and withdraw consent. If the information may leave Québec, say that too (s. 8).

A person who provides their information after receiving that notice consents to the stated purposes (s. 8.3). In practice, that is one sentence under your form, with a link to the policy.

4. Technology that identifies, locates, or profiles

If your site uses technology that can identify a person, locate them, or profile them, you must inform them first and tell them how to activate those functions (s. 8.1). The Commission d'accès à l'information draws the practical rule from this: those functions are off by default, and the visitor turns them on.

The Commission's own example is profiling cookies: a notice on the first visit, and nothing active until the visitor chooses it. An advertising pixel does the same job. The Act does not name other tools such as analytics, embedded maps or videos, so the answer depends on what each tool does with the data. Analytics that follow nobody from site to site do not raise the same question as a tool that builds an advertising profile.

5. Tools hosted outside Québec

Before communicating personal information outside Québec, you must carry out a privacy impact assessment and frame the communication with a written agreement. That also applies when you entrust a provider outside Québec with collecting or keeping the information (s. 17). The assessment is proportionate to the sensitivity and quantity of the information (s. 3.3).

On a website, that covers the services behind the form, the newsletter, the booking tool, and the analytics. Start by listing those services and where each one keeps its data.

6. An incident register

If a confidentiality incident presents a risk of serious injury, you must promptly notify the Commission and the people concerned (s. 3.5). You must keep a register of every incident, including the ones you do not report (s. 3.8).

7. Portability

Since 22 September 2024, a person can ask that the computerized information they gave you be handed back in a structured, commonly used technological format (s. 27). If your contact requests sit in an inbox, you need to be able to find one person's messages and export them.

The penalties

• Administrative penalties: up to $10 million or 2% of worldwide turnover (s. 90.12).
• Penal fines: from $15,000 to $25 million or 4% of worldwide turnover (s. 91), doubled on a subsequent offence (s. 92.1).

I read those ceilings as aimed at large companies.

For a small business, the realistic risk is a complaint from a customer and nothing to show in response.

What the law does not say

These claims come up often, and none of them is in the text.

• "Small businesses are exempt." The Act covers every enterprise, with no threshold (s. 1).
• "You need a cookie banner for everything." The "highest level of confidentiality by default" rule expressly excludes browser cookie settings (s. 9.1). What requires the visitor to opt in is technology that identifies, locates, or profiles.
• "The site must be hosted in Canada." The Act requires an assessment and an agreement before information leaves Québec (s. 17). It does not forbid it from leaving.

Checklist

• The title and contact information of the person in charge are on the site
• The privacy policy describes what this site collects, in everyday language
• Every form carries a notice: what the information is for, and a link to the policy
• No profiling tool activates before the visitor has chosen it
• A list of third-party services exists, with where each one keeps its data
• The assessment is done for the ones that keep data outside Québec
• An incident register exists, even if it is empty
• You know how to pull out one person's information when they ask for it

Sources

• Act respecting the protection of personal information in the private sector (P-39.1), LégisQuébec
• Main changes brought by Law 25, Commission d'accès à l'information (in French)
• Guidelines on the criteria for valid consent, Commission d'accès à l'information (in French)

If you would rather have it done for you, compliance is offered as a fixed-price package: audit, policy, consent, cookies and register, in two to three weeks.

If you are planning a new site, settle these points before the build, because that is when the tools get chosen. A review of your current site is free.