The Law 25 basics your website must show, set up properly.
Quebec's privacy law applies to every business that collects personal information, and even a contact form counts. We implement the website-facing requirements: privacy officer published, bilingual privacy policy, consent done right, and hosting that keeps data in Quebec.
What the setup includes
Four deliverables, implemented on your website and written for what you actually collect. No copied templates, no boilerplate.
Privacy officer page
The person responsible for protection of personal information, with title and contact details published on your site as the law expects.
- Name, title and contact details published
- Linked from your footer and policy
- Set up where visitors expect to find it
Privacy policy
Your practices written in clear language, French and English, tailored to what your site actually collects, not a copied template.
- Clear language, no legal jargon
- French and English versions
- Matched to what your site collects
Consent & forms
Consent banner configured, forms trimmed to collect only what's needed, and consent collected purpose by purpose.
- Consent banner configured honestly
- Forms trimmed to the essentials
- Purpose-by-purpose consent
Incident-ready basics
A confidentiality incident register template and the notification steps documented, so a breach doesn't find you improvising.
- Incident register template provided
- Notification steps documented
- Contacts ready before you need them
What Law 25 expects from your website
Five obligations touch your website directly. Here is what the law expects, and what we set up for each one.
A published privacy officer
Every enterprise must designate a person responsible for the protection of personal information and publish their title and contact information. We build that page and put it where visitors expect it.
Policies in clear language
Your policies and practices around personal information must be published in clear language. We write yours in French and English, matched to what your site actually collects.
Proper consent
Consent must be collected properly, purpose by purpose, before personal information is used. That covers your forms, your cookie banner and your analytics.
Incident register & notification
You must keep a register of confidentiality incidents, and notify the Commission d'accès à l'information and affected persons when an incident presents a risk of serious harm. We set up the register template and document the steps.
Assessment before data leaves Quebec
Before personal information is communicated outside Quebec, a privacy impact assessment is required. Hosting your site and backups in Quebec keeps that burden off your plate.
This is general information, not legal advice. Full compliance also covers processes beyond the website.
Why businesses do this now
The law is in force and it applies broadly. The good news: the website gaps are known, repeatable and fixable.
It applies to you
Law 25 covers businesses of every size that collect personal information about Quebec residents. There is no small-business exemption; a contact form is enough.
Penalties are real
The law provides for significant administrative penalties. The practical risk is just as real: clients notice when a business is careless with their information.
Most sites aren't ready
Missing privacy officer, English-only policy, forms collecting too much. The gaps repeat from site to site, and they are fixable.
A track record you can check
More than 14 years of experience in web, SEO and IT, proudly serving Quebec businesses since 2020.
Frequently asked questions
Does Law 25 apply to my small business?
Yes. Law 25 applies to any enterprise that collects personal information in Quebec, whatever its size; a contact form or an appointment request is enough. The size of your business affects how you meet the requirements, not whether they apply. This is general information, not legal advice.
Will this make my business compliant?
We implement the requirements visible on your website: the published privacy officer, the bilingual policy, consent and forms. Full compliance also involves internal processes, training and governance that go beyond the website, and we are transparent about that line. This is general information, not legal advice.
What is a privacy impact assessment?
It is an evaluation Law 25 requires in certain cases, including before personal information is communicated outside Quebec. Hosting your site and its backups in Quebec avoids triggering that requirement for your website data. This is general information, not legal advice.
Do I really need a consent banner?
If your site uses cookies or analytics that touch personal information, consent must be collected. We configure the banner to be honest and usable, no dark patterns and no wall of legalese. This is general information, not legal advice.
What does the setup cost?
It depends on the size of your site and what you collect. We start with a free review of your current site, then give you a fixed quote for the work. No surprises.
Get the website side of Law 25 off your worry list.
Start with a free review. We look at your current site, the policy, the forms, the banner and the hosting, and we tell you exactly which website-facing requirements are missing.
Get your free consultation →