Law 25 is no longer a deadline on the horizon: its obligations are in force, and they apply to every business that collects personal information in Québec. A client list, employee files, résumés received by email: that is all it takes to be covered.
For many SMEs, the real question is not whether the law applies, but where to start. Here is what actually needs to be in place.
Does Law 25 apply to your business?
Yes, as soon as your business collects, holds, uses or communicates personal information in Québec. The law sets no size threshold: a three-employee SME is subject to it just like a large corporation.
The information covered goes well beyond client data. Your employees’ files, candidates’ résumés and the contact details gathered through your website or newsletter are all personal information within the meaning of the law.
Which obligations are already in force?
Most of the regime applies right now. Concretely, your business must today:
- designate a person in charge of the protection of personal information: by default, that role falls to the highest-ranking officer, who may delegate it in writing; the person’s title and contact information must be published, notably on your website;
- keep a register of confidentiality incidents and, when an incident presents a risk of serious injury, notify the Commission d’accès à l’information and the individuals concerned;
- publish a clear privacy policy, written in plain language;
- collect personal information only with valid consent: on your website, non-essential cookies must be turned off by default, which is exactly what the consent banner is for;
- carry out a privacy impact assessment (PIA) before certain projects and before communicating personal information outside Québec;
- honour the right to data portability, in force since 2024;
- collect only what is necessary, then destroy or anonymize the information once its purpose has been fulfilled.
What does your business risk if it falls short?
Some of the harshest penalties in the country. The Commission d’accès à l’information can impose administrative monetary penalties of up to 10 million dollars or 2% of worldwide turnover, whichever is greater.
Penal offences expose the business to fines of up to 25 million dollars or 4% of worldwide turnover. The law also creates a private right of action: an injured person can claim damages, punitive ones where the breach is intentional or results from a gross fault.
Beyond the figures, the process itself is costly: an investigation, document requests, corrective measures, all while management’s attention is pulled away from growing the business.
Key points to remember
The designated officer
By default, it is the business’s highest-ranking officer. The role can be delegated in writing to a team member or an outside provider.
The officer’s title and contact information must be published, notably on your website. A dedicated email address makes follow-up easier.
The incident register
Every confidentiality incident must be recorded, even a minor one: unauthorized access, loss, information sent to the wrong recipient.
If the incident presents a risk of serious injury, notifying the Commission d’accès à l’information and the individuals concerned is mandatory.
Cookies and consent
Your website’s non-essential cookies must stay off until the visitor has consented.
A banner that activates cookies by default, or whose only real option is “Accept all”, does not comply with the law.
Why is compliance also a business advantage?
Because it becomes a commercial argument. Large clients and public bodies increasingly require concrete privacy guarantees from their suppliers; documented compliance opens doors in calls for tenders.
The effect is even more direct in transactions. When a business is sold, the buyer’s due diligence now examines Law 25 compliance alongside the financial statements. On the ground, a non-compliant business becomes a priced-in risk: a price adjustment, a holdback on part of the payment, additional representations and warranties demanded from the seller.
A well-kept compliance file does the opposite: it reassures the buyer, speeds up the transaction and protects the value you have built.
Why consult a lawyer about Law 25 compliance?
Because compliance is not solved by downloading a template policy. Every business collects different information, for different purposes, with different tools: the exercise has to start from your reality, not from a generic model.
Legal guidance helps set the priorities: mapping the information you hold, designating and equipping the officer, setting up the register, reviewing the privacy policy and the cookie banner, preparing PIAs where needed.
At Meka Avocat, we guide Québec businesses of all sizes through their compliance work, with a pragmatic approach: focus the effort where the risk is real, and document every step.
Frequently asked questions
Does Law 25 apply to small businesses?
Yes. The statute covers every enterprise that collects personal information in Quebec, whatever its size, including information about its employees, its clients and the visitors to its website.
Which obligations are already in force?
Appointing a person in charge of the protection of personal information and publishing their contact details, keeping a register of confidentiality incidents and reporting them, a clear privacy policy, consent for non-essential cookies, and the right to data portability.
What does a non-compliant business risk?
Administrative monetary penalties and penal fines with high ceilings, together with a private right of action in damages. The reputational risk, when an incident becomes public, is often the most costly.
Where does a compliance project start?
With mapping the personal information held, where it sits and who has access to it. Everything else, the policies, the register and the contract clauses with suppliers, follows from that inventory.
Where does your compliance stand?
Whether your work is under way or still ahead of you, a diagnostic quickly identifies the gaps and turns them into a realistic action plan. Better to do it now than in the middle of a confidentiality incident, or of a buyer’s due diligence.
Law 25 compliance sits alongside the company’s other documentary obligations. It is prepared with the same rigour as due diligence, and becomes a point of scrutiny the moment a transaction appears: buyers now examine how you handle personal information, and our outside general counsel service.
Book a consultation
Lawyer, member of the Barreau du Québec since 2014, founder of MEKA AVOCAT. This text sets out general legal information: it describes rules that apply broadly, not the answer to one particular case, and does not replace advice on your situation.
