Law 25 overhauled privacy protection in Quebec's private sector. Its obligations came into force in stages between September 2022 and September 2024, and they apply to small businesses just as they do to large corporations, whether you operate in French, English or both.
Many companies published a privacy policy, named a privacy officer… and stopped there. Yet much of the law is really about security: protecting information, detecting incidents, recording them and responding properly. That is exactly where our team comes in.
We are not lawyers
Our team handles the security side of Law 25 and its practical implementation. We don't provide legal advice: we work alongside your legal counsel and clearly flag the points they should validate.
Governance: roles, registers and assessments
Person in charge of the protection of personal information
By default, this is the person with the highest authority in the business, but the role can be delegated in writing (s. 3.1). We help you clarify the role, prepare the delegation if needed, publish the officer's title and contact information on your website, and, above all, equip that person for the security side of the job. Our article on the privacy officer's security role gives an overview.
Incident register and response
Every confidentiality incident must be recorded in a register (s. 3.8). Those presenting a risk of serious injury must be reported to the Commission d'accès à l'information (CAI) and to the people affected (s. 3.5). We give you a ready-to-use register and a simple procedure: who does what, how to assess the risk, who to notify. The CAI received 518 incident notices between January 1 and December 10, 2025, so this is far from theoretical. See also our confidentiality incident register template.
Privacy impact assessments (PIA)
A PIA (known in French as an EFVP) is required for any project to acquire, develop or overhaul an information system involving personal information (s. 3.3): a new payroll system, a CRM, a client portal. We provide a tailored template and handle the security portion: hosting, access, encryption, vendors. Learn more in our article on privacy impact assessments and security.
Your website and your security safeguards
Cookies and consent
Technologies that can identify, locate or profile a person must be turned off by default (s. 8.1). We review your website: cookies, advertising pixels, analytics tools, consent banner, and a privacy policy written in clear, simple terms.
Security safeguards
The law requires reasonable security measures, proportionate to the sensitivity of the information. We check what matters: access control, multi-factor authentication, encryption, backups, retention and destruction of data. If needed, a full cybersecurity audit goes deeper on this front.
Why start with security
A well-written privacy policy has never stopped ransomware. It is the incident that exposes a business: to its clients, to the regulator, sometimes in court. By putting security at the centre of your compliance work, you reduce the risk of an incident and you are ready to respond if one happens anyway.
We work remotely or on site anywhere in Quebec. Documents can be prepared in English, in French or both, ready for your leadership to adopt.