Law 25 Privacy Policy: Required Content and a Template

In 2023, a Montréal renovation contractor copied a privacy policy off the internet. It cites the European GDPR, mentions "your state of residence" and promises never to share data. Meanwhile, the website runs an ad pixel and a quoting tool hosted in the United States.

A document like that protects neither customers nor the business. Yet Québec's privacy regulator, the Commission d'accès à l'information (CAI), published an explanatory guide in December 2023 that spells out what belongs in a privacy policy. Here is the expected content, item by item, with an outline you can adapt.

Who must publish a privacy policy under Law 25?

Any business that collects personal information through technological means must publish a privacy policy on its website. Section 8.2 of the Act respecting the protection of personal information in the private sector requires a policy "drafted in clear and simple language," disseminated by any appropriate means to reach the people concerned. The same goes for the notice of any amendment. (The Act's English text calls it a "confidentiality policy"; everyone else says privacy policy.)

According to the CAI's guide, the obligation has applied since September 22, 2023, and collecting by email, website or app is enough to trigger it. A simple contact form puts you in scope.

How you disseminate it depends on context. The CAI gives three examples: a link to review before placing an online order, a message displayed the first time someone opens an app, or a leaflet included in the packaging of a connected device.

Privacy policy or governance policy?

The privacy policy informs the public about collection through technological means; governance policies frame your internal practices. The CAI's guide insists that the two not be confused, and that neither be merged with your terms of use.

The title and contact information of your person in charge of the protection of personal information must also be published on your website (s. 3.1). The privacy policy is the natural place for it.

What a Law 25 privacy policy must contain

The content of a privacy policy flows mainly from section 8, which sets out what you must tell people when collecting their information, and from section 8.1. The CAI says so itself: no regulation sets this content for the private sector, so its suggestions build on those obligations, with a few additions borrowed from public-sector rules.

• Business name, effective date and date of last update (CAI guide).
• Technological means of collection: forms, email, app, cookies, video surveillance (s. 8).
• Information collected, by category, and the purposes of collection (s. 8).
• Third parties collecting on your behalf, and third parties or categories of third parties you share information with: payment platform, newsletter tool, IT provider (s. 8).
• The possibility that information is communicated outside Québec (s. 8). The CAI's example is a cloud host located in Ontario.
• Use of any technology that can identify, locate or profile people, and how to activate those functions, which must be off by default (s. 8.1).
• Ways to refuse certain collection, and the consequences of refusing (CAI guide).
• Categories of staff with access to the information, and retention periods (s. 8, required on request; the CAI encourages sharing them up front).
• Rights of access and rectification, the right to withdraw consent (s. 8) and how to file a complaint.
• Contact information for your person in charge of the protection of personal information (ss. 3.1 and 8).
• A short description of security measures: physical, technological, administrative (optional, per the CAI).

Template: a privacy policy outline to adapt

The outline below covers the expected items in nine sections, with headings phrased as questions, an approach the CAI suggests testing. Replace each bracketed item with your own facts.

1. Who are we? Business name, address. Policy effective date; last updated date.
2. What information do we collect, and how? Example: "When you fill out our quote request form, we collect your name, email address, phone number and the address of the job site."
3. Why do we collect it? One purpose per line: prepare the quote, invoice, handle complaints.
4. Who has access to it? Staff categories; vendors by name or category; province or country if information is hosted outside Québec.
5. Do we use cookies or other trackers? Categories, purposes, third parties, and a link to the preferences panel (see our guide to Law 25 and cookies).
6. How long do we keep your information? Retention period by category, then destruction or anonymization (s. 23).
7. How do we protect it? Two or three concrete examples, with no details an attacker could use.
8. What are your rights? Access, rectification, withdrawal of consent, complaints. Written responses within 30 days (s. 32).
9. Who should you contact? Title and contact information of the person in charge of the protection of personal information, and the option of contacting the CAI.

Close with a note on amendments: where the notice will be published and how people will be informed.

Writing in clear and simple language

The Act requires clear and simple language, and the CAI points out that clarity is judged from the reader's perspective, not the writer's. Its guide recommends writing in "we" and "you," keeping to one idea per sentence, using everyday words and having colleagues, then a few customers, read the draft.

The CAI also advises documenting your thinking and decisions as you draft, which helps show the seriousness of your approach. In its October 2026 page on deceptive design, it notes that a privacy policy can itself become misleading when its language is complex or confusing.

One more Québec-specific point: commercial websites of businesses in Québec must be available in French, and that includes the policy. If you operate from Ottawa or Toronto and serve Québec customers, ask your counsel what applies to you.

Common mistakes

• A foreign template that cites the GDPR or "your state" and says nothing about Québec.
• A false promise, such as "we never share your data," while the site sends data to advertising platforms.
• No date, no designated person in charge, no contact information.
• A policy that is hard to find, buried at the bottom of a secondary page.
• A policy never updated after adding new software or a new campaign.

This outline is a starting point, not a ready-to-publish document: validate your policy with your legal counsel before putting it online. If you are starting from scratch, follow our 30-day Law 25 plan. To check that what your policy says matches what your systems actually do, book a free consultation or explore our Law 25 compliance support.