Law 25 for a website

This skill is general information, not legal advice. It reads the Act for a small-business website. For a legal opinion, ask a lawyer; for the regulator's position, ask the Commission d'accès à l'information (CAI).

Law 25 (the 2021 modernization of the Québec private-sector privacy Act, P-39.1; official French title: Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ, c. P-39.1)) applies to every enterprise that collects personal information in Québec, with no size threshold (s. 1). A contact form asking for a name and an email address is enough. Section numbers below refer to the Act as read to 10 June 2026; check LégisQuébec for the current text before relying on them.

The seven obligations that reach a website

1. Person in charge, shown on the site (responsable de la protection des renseignements personnels, s. 3.1). By default the highest authority in the enterprise, unless delegated in writing. Their title and contact information are published on the website.
2. Privacy policy in plain language (politique de confidentialité, s. 8.2). Published on the site when information is collected by technological means, in "clear and simple language", with notice of changes. It must describe what this site collects, not a generic or foreign template.
3. Notice at collection (s. 8, s. 8.3). At the moment of collection: purposes, means of collection, rights of access, correction and withdrawal of consent, and whether the information may leave Québec. One sentence under the form plus a link to the policy covers it in practice.
4. Technology that identifies, locates or profiles (s. 8.1). Inform the person first and say how to activate the function. The CAI reads this as off by default, on by the visitor's choice. Profiling cookies and advertising pixels are the usual cases; other tools depend on what they do with the data.
5. Tools hosted outside Québec (évaluation des facteurs relatifs à la vie privée, s. 17, s. 3.3). Before communicating information outside Québec: a privacy impact assessment and a written agreement, proportionate to the sensitivity and volume. Covers form backends, newsletters, booking tools and analytics.
6. Incident register (registre des incidents de confidentialité, s. 3.5, s. 3.8). Notify the CAI and the people concerned promptly when an incident presents a risk of serious injury; keep a register of every incident, reported or not.
7. Portability (s. 27, since 22 September 2024). A person can ask for the computerized information they gave you in a structured, commonly used technological format. You must be able to find and export one person's data.

Penalties