Quebec Law 25 for Small Business: Where to Start (30-Day Plan)

A 22-person food distributor in Laval gets a vendor questionnaire from its biggest customer: "Are you compliant with Quebec Law 25? Attach your privacy policy and the name of your privacy officer." The president has neither, and 30 days to answer.

Thirty days is enough to put the essentials in place, as long as you work in the right order. This plan is written for businesses of 5 to 50 people with no in-house lawyer or IT team, whether you are based in Montréal or elsewhere in Canada with Québec customers. Each step links to a more detailed guide.

Does Law 25 apply to my small business?

Yes: the Act respecting the protection of personal information in the private sector applies to any person carrying on an enterprise in Québec, with no threshold for headcount or revenue. Its new obligations came into force in phases on September 22 of 2022, 2023 and 2024, so all of them apply today. If your business is based outside Québec but serves Québec customers, ask your legal counsel whether and how the Act applies to you.

The Act does require your policies to be "proportionate to the nature and scope of the enterprise's activities" (s. 3.2). A 22-person distributor does not need a 40-page manual. It needs short documents that are actually applied and kept current. To understand what is at stake, read our article on Law 25 fines and penalties.

The 30-day plan at a glance

The plan follows a simple logic: first know who decides and what you hold, then prepare for the worst, then fix what is visible, and finally formalize.

Week 1: designate your privacy officer and take inventory

Week 1 answers two questions: who is in charge, and what personal information do you hold? By default, the person in charge of the protection of personal information (often called the privacy officer) is the person with the highest authority in the business (s. 3.1). That person can delegate the role in writing, in whole or in part. The CAI recommends choosing someone competent with real decision-making power, and notes that the head of the business remains accountable.

• Sign the delegation if there is one, and publish the privacy officer's title and contact information on your website. The CAI does not need to be notified.
• Build the inventory in a simple spreadsheet: what information, about whom (customers, employees, applicants), where (software, cloud, paper), who has access, how long you keep it, and whether it is hosted outside Québec.
• Start with your software: accounting, payroll, CRM, email, shared drives.

Week 2: prepare for confidentiality incidents

Every business must keep a register of its confidentiality incidents, minor ones included (s. 3.8), and it is often the first document anyone asks for. An email sent to the wrong customer already counts as an incident.

• Create your register from our incident register template. It must be kept for at least five years under the Regulation respecting confidentiality incidents.
• Write a one-page procedure: who to call, how to contain the incident, who assesses the risk.
• Prepare a grid to assess the risk of serious injury: sensitivity of the information, anticipated consequences, likelihood of misuse (s. 3.7).

Reminder: Law 25 has no 72-hour deadline. It requires you to notify the CAI and the people concerned "promptly" when an incident presents a risk of serious injury (s. 3.5). Our guide to reporting an incident to the CAI walks through the process.

Week 3: get your website in order

Your website is the most visible part of your compliance, and the easiest to check from the outside. Three tasks:

• Privacy policy. Any business that collects personal information through technological means must publish one, in clear and simple language (s. 8.2). Start from our Law 25 privacy policy outline.
• Cookies and trackers. Those that can identify, locate or profile visitors must stay off until the visitor turns them on (s. 8.1). See our guide to Law 25 and cookies.
• Web forms. Ask only for the information needed for the stated purposes (s. 5). A date of birth on a quote request form, for instance, is rarely justified.

Week 4: adopt your policies and check baseline security

Your governance policies must at minimum cover the retention and destruction of information, staff roles and complaint handling, and be approved by the privacy officer (s. 3.2). Detailed information about them must then be published on your website in clear and simple language.

On the security side, section 10 requires measures that are reasonable given the sensitivity and quantity of the information. For a small business, the baseline looks like this:

• Multi-factor authentication on email and cloud applications.
• Automatic backups, validated by an actual restore test.
• Departing employees' accounts disabled the same day.
• Written contracts with vendors that handle personal information for you, including confidentiality clauses (s. 18.3).
• A privacy impact assessment before deploying any new software that touches personal information (s. 3.3).

After 30 days: what comes next

After 30 days the essentials are in place; from then on, compliance becomes routine. Train your staff at least once a year, phishing included. Get ready for access requests: the privacy officer must respond in writing within 30 days (s. 32), and since September 2024 that includes providing information in a structured, commonly used technological format when asked (s. 27). Review the inventory and the privacy policy every year, or whenever you add new software.

To go further, our Law 25 cybersecurity checklist lays out a 90-day plan focused on technical controls.

This plan explains your obligations in plain language and is not legal advice: validate your documents and decisions with your legal counsel. If you would like to check your starting point with us, book a free consultation.