Quebec’s Law 25 for businesses: the complete guide

According to the Commission d’accès à l’information (new tab), personal information is any information that allows a natural person to be identified, directly or indirectly. The law applies to the information your business collects, holds, uses or discloses, whatever the medium (written, audio, visual, computerized), even when a third party keeps it for you. It doesn’t need to be filed in a record under the person’s name.

In practice, a business almost always holds personal information: contact details of customers and prospects, purchase histories, employee files, job applications, messages received through the website, camera recordings. The law covers every step: collection, use, disclosure to third parties, retention and destruction.

The obligations came into force in three stages. The following table summarizes them with a realistic first step for a business.

The Commission specifies that the person with the highest authority in the business (new tab), for example its owner or chief executive, is by default responsible for protecting personal information. This role can be delegated in writing, in whole or in part, to someone able to carry it out; the Commission recommends choosing someone with the necessary skills and significant decision-making power. Even after delegation, the person with the highest authority remains accountable and must provide the necessary resources.

The title and contact details of the person in charge must be published on the company’s website, or communicated by any other appropriate means if there is no website. The Commission does not need to be informed. Publish a lasting role and address, for example “Person in charge of the protection of personal information” and a dedicated email address, rather than a personal inbox that will change at the next departure.

The role is not honorary. The person in charge approves governance policies, receives and handles access and correction requests, takes part from the start in privacy impact assessments, receives notices from providers when confidentiality is breached and must be consulted to assess the risk of an incident. In a business, these tasks take a few hours a month, provided everyone knows whose job they are.

Businesses must establish and implement governance policies and practices. According to the Commission, they must at least set rules for retention and destruction, the roles and responsibilities of staff throughout the life cycle of the information, and a complaint-handling process. They must be proportionate to the nature and scale of your activities, and detailed information about them must be published on your website in clear and simple terms.

For a business, this document can fit in two or three pages. Start with an inventory: what information you hold, why, where it is (accounting software, email inbox, spreadsheet, customer management tool, paper), who can access it and how long you keep it. That inventory then serves for everything: writing the privacy policy, answering an access request, responding to an incident.

Set retention periods by type of document, taking into account the periods required by other laws, for example tax rules. The guide to organizing your business documents as a team offers a filing and access method that makes this discipline easier.

The Commission insists on one principle: before even asking for consent, you must assess whether the collection is necessary (new tab). Collection is necessary if the objective is legitimate, important and real, and if the invasion of privacy is proportionate to that objective. When in doubt, the information is considered unnecessary. It is up to the business to show that it is necessary.

At the time of collection, tell the person why the information is collected, by what means, about their rights of access and correction and their right to withdraw consent. Where applicable, also mention the third parties for whom the collection is made, the third parties or categories of third parties to whom the information will be disclosed, the possibility that it will be disclosed outside Quebec and any use of a technology that can identify, locate or profile them. The Commission gives a telling example: if you store information with a cloud provider in Ontario, you must say so.

On request, you must also say which information you collected, who has access to it in the business, how long it is kept and how to contact the person in charge. As a general rule, you can’t refuse a service or reject a job application because a person refuses to provide information, unless the collection is necessary for a contract, authorized by law, or there are reasonable grounds to believe the request is unlawful.

Review your forms with this lens. A quote form that requires a date of birth or a full address for a simple first contact probably asks for too much.

Consent is needed to use or disclose information for purposes other than those announced, or to disclose it to third parties when no exception applies. According to the Commission (new tab), it must be manifest, free, informed, specific, temporary, granular (requested for each purpose), understandable and, when requested in writing, separate from any other information. A pre-checked box buried in terms of use does not meet these criteria.

Information is sensitive when it is medical, biometric or otherwise intimate, or when its context creates a high reasonable expectation of privacy. Using it for other purposes requires express consent, given through an action or statement that leaves no doubt. For a minor under 14, consent is given by a parent or guardian.

The Commission has published guidelines on the criteria for valid consent (new tab) (in French) with examples and good practices. For a business, three habits cover most of it: separate the checkboxes (for example, answering the request on one side, receiving the newsletter on the other), explain each use in one simple sentence, and keep a record of the date and wording of the consent.

Publishing a privacy policy is mandatory if you collect personal information using any technology. It must be written in clear and simple terms and tell people what information is collected and why, which third parties it may be disclosed to, what protection measures are in place, whether cookies are used, what their rights and remedies are, and what changes have been made to the policy. The Commission offers a guide to writing a privacy policy (new tab) (in French), which also reminds businesses that a privacy policy should not be merged with the website’s terms of use.

For technologies that can identify, locate or profile a person, you must inform them from the start that the technology is used and how to activate those functions. They cannot be turned on by default: the person must do it themselves, voluntarily. The law defines profiling as collecting and using information to assess certain characteristics of a person, in particular their preferences, interests or behaviour. In our reading, which does not replace legal advice, retargeting pixels generally fit this description.

So take stock of what your website loads: audience measurement, advertising pixels, chat, embedded videos and maps, third-party fonts or scripts. Ask each provider what it collects and whether it sets cookies before consent. The guide Law 25 and your website details what to display and where, with a one-hour checklist; the complete guide to business websites places these obligations among the site’s other projects. To measure your results without blocking everything, see also the measurement section of the guide on digital marketing for businesses.

A confidentiality incident (new tab) is any access, use or disclosure of personal information that the law does not authorize, or its loss. The Commission’s examples are ordinary: an employee who looks at a file for no reason, an email sent to the wrong recipient, phishing or ransomware. Your business remains responsible even if the incident happens at a provider that keeps the information for you.

As soon as you have reason to believe an incident has occurred, take reasonable measures to reduce the risk of injury and prevent it from happening again. Then assess the risk, considering the sensitivity of the information, the anticipated consequences and the likelihood of harmful use, and consult your person in charge. If the risk of serious injury exists, you must promptly notify the Commission, using its form, and the people concerned, with a description of the information involved, the circumstances, the date, the measures taken and the contact details of someone they can reach.

All incidents, even those without a serious risk, must be recorded in a register that the Commission can request. The register describes the information involved, the circumstances, the dates, the number of people affected, the risk assessment, the notices sent and the measures taken. It is kept up to date and retained for at least five years after the business became aware of the incident.

Prevention costs less. The Commission recommends, among other things, limiting access to the employees who need it, training staff on phishing and passwords, encrypting devices and communications and applying updates. The guide on Seraf’s CTO advisor offers a checklist for access security.

A privacy impact assessment, or PIA (évaluation des facteurs relatifs à la vie privée, EFVP, in French), is an impact analysis. It checks a project’s compliance, identifies privacy risks and plans measures to reduce them. The Commission makes it mandatory in three situations: before disclosing information outside Quebec or entrusting its collection, use or retention to someone outside Quebec; for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information; and before disclosing information without consent for research purposes.

The notion of an information system is broad. The Commission mentions collaboration or video conferencing software, artificial intelligence systems, video surveillance and payroll management; a members’ area on a website or a mobile app are examples of electronic service delivery. For a business, adopting new management software, an AI tool or an online client area therefore often triggers a PIA.

The assessment must be proportionate to the sensitivity, purpose, quantity, distribution and medium of the information. For a common tool, a few pages are often enough. The Commission publishes a guide to carrying out a PIA (new tab) (in French) and a report template. The person in charge must take part from the start of the project.

You can entrust personal information to a provider without people’s consent when this is necessary for a mandate or a service contract. The Commission specifies that this mandate or contract must be made in writing (new tab) and set out the measures to protect confidentiality, limit use to the purposes of the contract and prevent retention after it expires. The provider must notify your person in charge without delay of any breach of confidentiality.

Before disclosing information outside Quebec, including to another province, or entrusting a provider located elsewhere with collecting, using or keeping it for you, a PIA is required. The disclosure can only take place if the information will receive adequate protection, and it must be covered by a written agreement. Your business remains responsible for the information it entrusts. Yet many online tools (email, storage, accounting, newsletters, AI tools) host data outside Quebec.

Before adopting an AI tool or cloud software, ask the provider a few questions in writing:

• Where is the data hosted, and which subcontractors handle it?
• Is the data you enter used to train its models or for purposes other than the service?
• What security measures protect the data, and how will you be notified of an incident?
• Can you export your data in a common format and have it deleted at the end of the contract?
• Does the contract provide for confidentiality, limited use and no retention after it ends?

Fully automated decisions have their own rules. If you use personal information to make a decision without human involvement, for example to grant credit or prioritize a request, you must inform the person no later than when you communicate the decision and give them the opportunity to submit observations to a staff member who can review it. On request, you explain the information used and the main factors behind the decision. The guide on the AI executive team shows a use in which AI prepares a recommendation and the decision remains human.

Anyone can ask to access their information or have it corrected. The person in charge must respond within 30 days; failing to respond within that time is treated as a refusal, which the person can contest before the Commission. If a request is unclear, help the person specify what they are looking for, and give reasons for any refusal by citing the provision of the law that justifies it.

Since September 2024, a person can also ask that computerized personal information collected from them be communicated to them in a structured, commonly used technological format, or transferred to a business authorized to receive it. Information created or inferred by the business is excluded. Any new information system must allow this, which makes it a good criterion when choosing software.

Finally, a person can require you to stop disseminating their information, or to de-index a hyperlink attached to their name, if the dissemination breaks the law or a court order, or causes serious injury to their reputation or privacy. Prepare a simple procedure: an address to receive requests, a proportionate identity check, a thorough search of the information in your systems and a response template. For employee files, the guide on Seraf’s HR advisor covers the limits to respect.

When the purposes for which information was collected have been achieved, the business must destroy or anonymize it (new tab), subject to retention periods set by another law. The Commission recommends a records management procedure, a retention schedule and a destruction method suited to the medium: a cross-cut shredder for paper, secure deletion for media that will be reused, physical destruction for media that won’t. Note that anonymization must meet criteria set by regulation.

The penalties are real. According to the Commission (new tab), administrative monetary penalties can reach $10 million or 2% of worldwide turnover. They target, among other things, failing to inform people adequately, to report an incident presenting a risk of serious injury, to take security measures or to give notice of an automated decision. On the penal side, fines for a business range from $15,000 up to the greater of $25 million or 4% of worldwide turnover, and they are doubled for a repeat offence.

These maximum amounts should not paralyze a business. To set a fine, the judge considers in particular the seriousness and duration of the offence, the sensitivity of the information, intent or negligence, and efforts to mitigate the consequences; the Commission also publishes a framework explaining how it decides on an administrative penalty. A business can also commit to the Commission to correct a breach. What protects you best is a documented, sincere approach.

You don’t need to do everything in one week. This plan gives a realistic order for a business with 5 to 50 employees.

1. Week 1: name and take stock. Confirm who is in charge, delegate in writing if needed and publish the title and dedicated email address on the website. Inventory the information you hold, where it is and who can access it.
2. Week 2: the website and forms. Remove unnecessary fields, add collection notices, take stock of cookies and set profiling tools so they are off by default. Publish or update the privacy policy.
3. Week 3: incidents and providers. Create the incident register and a one-page procedure. List the providers that hold information, check the contracts and identify those hosting data outside Quebec to plan their PIAs.
4. Week 4: rules and habits. Write the governance policies (retention and destruction, roles, complaints), publish information about them, prepare an access request response template and give the team a short training on phishing and access.

Then schedule a yearly review, and redo a PIA every time you adopt a new tool that touches personal information.