Quebec’s privacy law is not new anymore. Law 25 came into force in three waves between September 2022 and September 2024, and the transition period is long over: the obligations now apply in full to every private business that collects personal information in Quebec, whatever its size. A name and an email address in a contact form already count. This Law 25 checklist covers the website side of compliance, the part your visitors and the regulator can see in thirty seconds.
The 8-point website checklist
1. Name a privacy officer and publish their title and contact
By default, the person with the highest authority in the company holds this role, and it can be delegated in writing to someone able to carry it out. Their title and contact information must be published on your website, as explained on the Commission d’accès à l’information page for businesses. A short privacy officer section in your footer or privacy page settles this.
2. Publish a privacy policy in plain language
If you collect personal information by technological means, which includes a simple contact form, you must write a confidentiality policy in simple, clear terms, publish it on your website, and announce it when you change it. A template copied from a foreign site rarely matches what your site actually collects.
3. Collect only what you need, with consent for each purpose
Consent must be clear, free, informed, and requested for each purpose in plain words. In practice: trim your forms to the fields you really use, say what each one is for, and never pre-check optional boxes such as newsletter signup.
4. Deal with cookies and tracking honestly
Analytics, advertising pixels and embedded videos can all collect personal information. Tell visitors what runs on your site and let them refuse what is not essential. Parameters that a visitor manages in their own browser are treated differently, but transparency about your tracking is the safe baseline.
5. Make the most private setting the default
For technological products or services offered to the public, confidentiality parameters must provide the highest level of confidentiality by default, without any action from the visitor. Nothing optional should start in the on position.
6. Have an incident plan and keep a register
Since September 2022, a confidentiality incident that presents a risk of serious injury must be reported to the Commission and to the people affected, and every incident must be logged in an internal register. Decide today who does what when something leaks, because improvising during an incident is how small problems become big ones.
7. Know where your data lives before it leaves Quebec
Law 25 does not force you to host in Quebec. It requires a privacy impact assessment before communicating personal information outside the province, to confirm it will be adequately protected. Hosting in Quebec simplifies that exercise, which is why we offer it, but the legal obligation is the assessment, not the postal code of the server.
8. Be ready for access and portability requests
People can ask what you hold about them, and since September 22, 2024 they can also ask for their computerized personal information in a structured, commonly used format. Know where customer data sits in your systems so a request does not turn into an archaeology project.
What happens if you ignore it
The Commission d’accès à l’information can now impose administrative monetary penalties on businesses of up to 10 million dollars or 2% of worldwide turnover, whichever is higher. Penal proceedings can reach 25 million dollars or 4% of worldwide turnover, and those amounts double for repeat offences. Enforcement aside, the quieter cost is trust: a website with no policy, no officer and pre-checked boxes tells careful customers exactly how their data will be treated.
Where to start if you are behind
Do the visible items first, because they are also the fastest: designate and publish your privacy officer, then get a real privacy policy online. Next, audit your forms and tracking against points 3 to 5. Finish with the internal pieces, the incident register and the data map, which take longer but do not need to be public. Most small business websites can cover this checklist in a few focused days. The CFIB’s Law 25 resource is a useful plain-language companion for the business side beyond your website, and our Law 25 website setup service handles the whole website side for you, from policy to consent banner to Quebec hosting with encrypted backups.
This article is general information, not legal advice. For situations involving sensitive data or complex data flows, talk to a lawyer.
Compliance is a habit, not a launch task
The checklist above describes a moment in time, and websites do not stand still. Every new form field, every new marketing pixel, every new tool that touches customer data can quietly move you out of line with your own policy. Build a simple reflex into how you run the site: when something new starts collecting personal information, update the privacy policy, check the consent banner, and note it in your data map. A quick review twice a year, perhaps when you renew hosting and when you plan the new year, keeps the paperwork honest. Businesses that treat privacy as ongoing maintenance spend a few minutes a month on it. Businesses that treat it as a one-time project tend to redo the whole exercise under pressure, usually right after a customer complaint or an incident.
Frequently asked questions
Does Law 25 apply to my small business?
Yes. The law applies to every private enterprise that collects, holds, uses or shares personal information in Quebec, with no minimum size. A solo contractor with a contact form is covered, the same as a chain of clinics.
Do I have to host my website in Quebec?
No. The law requires a privacy impact assessment before personal information is communicated outside Quebec, to ensure adequate protection. Quebec hosting makes that assessment much simpler, which is why many businesses choose it, but it is a simplification, not a legal requirement.
Is a cookie banner mandatory?
What the law requires is transparency and valid consent for collection, plus the highest confidentiality by default for public-facing technology. For most sites running analytics or advertising tags, a consent banner is the practical way to meet those duties.
Can I handle this myself or do I need a lawyer?
Most website items on this checklist are operational: publishing the officer, the policy, fixing forms and defaults. A lawyer becomes valuable when you handle sensitive data, share data with many partners, or operate outside Quebec. For everything on the website itself, we do it for our clients regularly.
Not sure where your website stands? Book a free audit and we will check every item on this list for you. Our maintenance and Quebec hosting plans keep it compliant after launch.
Technocure Digital Solutions is a bilingual Montreal digital agency with more than 14 years of experience in web, SEO and Google Ads, helping Quebec businesses grow online. More about us.
