Law 25 compliance: what a Quebec business actually has to do

Who does Law 25 apply to?

Any business operating in Quebec that collects, holds, uses or discloses personal information, regardless of size. The law sets no headcount or revenue threshold: a five-person company keeping employee files falls within its scope, exactly as a large organization does.

Two groups are consistently caught off guard. Small Quebec businesses, who assume the law targets large organizations. And head offices elsewhere in Canada or in the United States, who discover that holding information about Quebec employees or customers is enough to bring them in scope.

The useful question is therefore not whether you are covered, but what you hold and where. Employee files, customer lists, prospecting email, camera recordings, payroll records: all of it is personal information under the law.

A second driver often weighs more than the law itself: enterprise customers now request compliance attestations from their suppliers. Many businesses discover their obligations inside a customer questionnaire, days before a deadline.

What are the obligations, concretely?

Five obligations carry the essentials: designate a privacy officer, publish a governance policy, keep a confidentiality incident register, notify incidents presenting a risk of serious injury, and run a privacy impact assessment before certain projects.

Order matters. The officer must exist before anyone can answer for an incident; the register must exist before an incident occurs. Starting with the published policy (the most visible item)produces surface compliance that does not survive the first real question.

• Designate a privacy officer. By default the person with the highest authority in the business. The role can be delegated in writing. The title and contact details must be published on the website.
• Publish a governance policy. Covering roles, retention, destruction, complaint handling and the use of third parties. Public, and written in plain language.
• Keep a confidentiality incident register. Every incident is recorded, notifiable or not. An empty register after several years is itself a warning sign to an investigator.
• Notify incidents presenting a risk of serious injury. To the Commission d'accès à l'information and to affected individuals, with diligence. Qualification accounts for the sensitivity of the information and the anticipated consequences.
• Run a privacy impact assessment (PIA). Before acquiring or redesigning a system that processes personal information, and before any disclosure outside Quebec.
• Honour individual rights. Access, correction, withdrawal of consent, de-indexation, and portability of computerized information.

What is the real exposure for a smaller business?

The law provides for administrative monetary penalties and penal fines, with caps set out in the text. For a smaller business, however, the most common consequence is not a fine: it is the contract lost because a customer asked for an attestation that could not be produced.

The maximum amounts are high and frequently quoted for effect. They describe a ceiling, not a practice: penalties actually imposed depend on severity, good faith and the measures taken. We do not lead with them, because waving a maximum figure is fear, not advice.

The practical risk is more mundane. A mishandled incident invites a complaint, and a complaint triggers a review of the whole arrangement, including parts unrelated to the incident. A business that documented its decisions can defend them; one that improvises discovers its gaps in front of the investigator.

Where do you start from zero?

With a map of the personal information you hold: what, where, why, who can reach it, and how long it is kept. Without that map you cannot write an accurate policy, qualify an incident, or answer an access request. Everything else follows from it.

This is done with the people who actually handle the data (payroll, sales, customer service)not from an org chart. That is where the shared spreadsheet outside the system turns up, or the mailbox used as an archive, or the vendor holding a full copy of the customer database.

Then comes the officer designation, then the documents: policy, incident procedure, register, PIA template. They are written from the map, not from a generic template: a downloaded template describes a business that is not yours, and works against you when your actual practice contradicts it.

How long it takes depends entirely on the starting point: the number of systems, how scattered the data is, and the availability of the people who know it. We do not announce a duration in advance, because announcing one would mean guessing.

Compliance and security: what is the difference?

Compliance documents what you do with personal information; security stops someone taking it. A business fully compliant on paper can be breached in an hour, and a well-protected business can be in default for never having designated an officer. Both are run together.

The law itself makes the connection: it requires security measures appropriate to the sensitivity of the information. A policy promising confidentiality without multi-factor authentication or tested backups describes an intention, not a measure.

That is why we treat compliance as one strand of an engagement rather than a standalone documentation exercise. The reverse (producing documents the technical reality does not support)manufactures an additional risk: that of an inaccurate declaration.

Frequently asked questions