Québec Law 25 for small businesses: what to do (10-point summary)

Law 25 updated Québec's private-sector privacy law. It applies to every business, even a one-person one, that keeps client names, emails or phone numbers. Here is what it asks, in plain words.

Version française

1. Name a privacy officer. By default it is the person with the highest authority (you, if you work alone). Publish the title and contact details on your website.
2. Write your internal rules. Who can see what, how long you keep data, how you handle a complaint. Summarise them in plain language on your website.
3. Publish a clear privacy policy. If you collect information online (form, newsletter, shop), say what you collect, why, and who can see it.
4. Ask for clear consent, for a specific purpose. One box per use, never pre-ticked. Sensitive information (health, finances) needs express consent.
5. Cookies and trackers: off by default. Tools that track or profile visitors must stay off until the person turns them on.
6. Keep an incident register. Every loss, theft or unauthorised access to personal information goes in it, even a minor one.
7. Report serious incidents. If there is a risk of serious injury, notify the Commission d'accès à l'information and the people affected, promptly.
8. Assess before sending data outside Québec or launching a new system that handles personal information (a privacy impact assessment).
9. Answer people's requests within 30 days: access to their information, correction, withdrawal of consent, and a copy in a common technological format (portability).
10. Destroy or anonymise information once the purpose you collected it for is met, following a written retention rule.

The law provides for administrative and penal sanctions. Steps 1 to 3 take one evening and cover the essentials for a small business.

General information, not legal advice. Official source: Commission d'accès à l'information du Québec.