Does your website comply with Quebec's Law 25?

Law 25 in thirty seconds

Law 25 modernizes Quebec's personal information protection rules. It came into force in stages between September 2022 and September 2024, and since that last date, every obligation applies. The part that surprises people most: it covers all businesses operating in Quebec, with no size exemption. The two-chair hair salon is covered just like the multinational.

"Personal information" means anything that can identify a person: a name, an email, a phone number, but also an IP address or browsing history. If your site has a contact form, you are collecting it. So let's look at what your site needs, point by point.

1. A privacy policy, in plain language

If your site collects information through technological means, and a form counts, you must publish a privacy policy written in clear, simple terms. Not a fifteen-page document copied from an American site: a page that explains what you collect, why, how long you keep it and who can access it.

The common-sense test: if your brother-in-law doesn't understand your policy after one read, it isn't clear enough.

2. A designated officer, with their name published

Every business must have a person responsible for the protection of personal information. By default, it's the highest-ranking person: the owner, in most small businesses. Their title and contact information must be published, and the website is the natural place, usually inside the privacy policy.

It's the simplest obligation on the whole list, and yet the one we see missed most often. Two lines on your site, and it's done.

3. Cookies that wait for permission

This is the most visible piece of the law. Any tool able to identify, locate or profile your visitors must be off by default. Google Analytics, the Meta pixel, remarketing tools: none of them should load before the visitor says yes.

Watch out for the classic trap: a cookie banner that appears while the trackers are already running in the background solves nothing. Refusing must also be as easy as accepting, and visitors must be able to change their mind later. That's exactly why, on the sites we deliver, the cookie management link stays available in the footer of every page.

4. Forms that ask only for what's needed

The law requires limiting collection to what is necessary. Does your quote form really need a date of birth? A number of employees? Every field has to justify itself. And at the moment of collection, people must know what their information will be used for: one sentence under the form, with a link to the policy, does the job very well.

5. A site served over HTTPS

The law requires reasonable security measures. For a website, the bare minimum is an SSL certificate: the padlock in the address bar, which encrypts what your visitors send you. A form transmitting personal information in the clear over an unsecured connection is, in 2026, indefensible.

6. Knowing where your data sleeps

A question rarely asked, but important: where are your site's and your forms' data hosted? If personal information leaves Quebec, which happens as soon as you use most major hosts and cloud tools, the law requires assessing the risks before sending it there. Your web provider should be able to answer in one sentence. If they don't know, that's a red flag.

7. A plan for when things go wrong

In the event of a confidentiality incident, a hacked mailbox, a leaked client file, you must keep an incident register and, if the incident presents a risk of serious harm, notify the Commission d'accès à l'information and the people affected. The reflex to remember: document, notify, fix. Don't hide.

The bottom line

Nothing on this list requires a big-company budget. Most of it comes down to a good policy, an honest banner, sober forms and a provider who knows where your data goes. The most expensive option, really, is doing nothing and letting a competitor look more trustworthy than you.