Law 25 (Bill 64) in Quebec: Compliance Guide for Businesses (2026)

Quebec's Law 25 changed how every business in the province must handle the personal information of its customers, employees and suppliers. It is not just a big-company problem: a ten-person firm with a customer list, a payroll file or a contact form on its website has the same core obligations as a bank.

This guide explains Law 25 in plain English: what it requires, since when, what the penalties are and, most importantly, how a small or mid-sized business can actually comply. You will also find a step-by-step compliance checklist and a section on the IT side, because a large part of Law 25 compliance happens inside your systems.

What is Law 25 (Bill 64)?

"Law 25" is the common name for An Act to modernize legislative provisions as regards the protection of personal information, introduced as Bill 64 and assented to on September 22, 2021. It amended several statutes, including the Act respecting the protection of personal information in the private sector, which governs businesses.

Its goal is straightforward: give people more control over their personal information, and require organizations to protect it better, be more transparent and be accountable. The Commission d'accès à l'information du Québec (CAI) enforces the law and publishes a summary of the main changes (in French) that is worth reading.

Personal information is any information about a natural person that allows that person to be identified, directly or indirectly: a name, an email address, a phone number, a date of birth, a social insurance number, an employee file, an IP address tied to an account, and so on.

Who does Law 25 apply to?

Law 25 applies to every business that collects, holds, uses or communicates personal information in Quebec, regardless of size or industry. There is no minimum number of employees and no revenue threshold.

In practice, almost every SMB is covered, because at a minimum it holds:

• employee information (HR files, payroll, contact details, benefits);
• customer and business contact details;
• data collected through its website (forms, newsletter sign-ups, analytics tools);
• documents exchanged by email, stored in Microsoft 365 or kept in business software.

Manufacturers, accounting and law firms, engineering firms, clinics and online retailers all have Law 25 obligations.

Law 25 timeline: 2022, 2023 and 2024

The obligations came into force in three phases. Since September 22, 2024, the whole law applies.

September 22, 2022

• Designate a person in charge of the protection of personal information.
• Report confidentiality incidents that present a risk of serious injury to the CAI and to the people affected.
• Keep a register of confidentiality incidents.

September 22, 2023

• Adopt and publish governance policies for personal information.
• Conduct privacy impact assessments (PIAs) in specific situations.
• Meet stricter consent requirements.
• Provide privacy by default, and tell people about technologies that can identify, locate or profile them.
• Inform people about decisions made exclusively through automated processing.
• Follow rules on destruction and anonymization, and respect the right to de-indexation.

September 22, 2024

• Respect the right to data portability: on request, provide a person's computerized personal information in a structured, commonly used technological format.

Law 25 obligations explained for SMBs

1. Designate a person in charge of personal information

By default, the person in charge is whoever has the highest authority in the business, usually the president or CEO. The role can be delegated, in whole or in part, in writing to an employee. The person's title and contact information must be published on the company website.

In an SMB, this person does not need to be a lawyer. They need to know what personal information the business holds, make sure policies are followed and coordinate the response when an incident happens. They can rely on legal counsel and on the company's IT provider for the technical side.

For the role, delegation and day-to-day duties in detail, see our guide to the Law 25 privacy officer.

2. Handle confidentiality incidents

A confidentiality incident includes unauthorized access to, use of or communication of personal information, or its loss. An email sent to the wrong person, a stolen unencrypted laptop, a compromised Microsoft 365 account or a ransomware attack can all be incidents.

When an incident occurs, the business must:

• take reasonable steps to reduce the risk of injury and prevent it from happening again;
• assess whether it presents a risk of serious injury to the people affected, considering how sensitive the information is, the possible consequences and how likely it is to be misused;
• if the risk is serious, notify the CAI and the people affected;
• record the incident in the register, whether or not it was reported.

The CAI can ask for a copy of the register. Even if yours is empty today, it has to exist.

3. Publish your governance policies

The business must adopt policies that govern how personal information is handled: who is responsible for what, at each stage of the information's life cycle (collection, use, retention, destruction), and how someone can file a complaint. These policies must be published on the website in clear, simple terms.

If you collect personal information through technological means, such as a web form or an app, you must also publish a clear privacy policy explaining what you collect and why.

4. Conduct privacy impact assessments (PIAs)

A privacy impact assessment (EFVP in French) is a review of privacy risks done before a project. Law 25 requires one in particular:

• for any project to acquire, develop or overhaul an information system or electronic service delivery that involves personal information (a new CRM, a payroll system, a custom application, a move to the cloud);
• before communicating personal information outside Quebec, for example when it is hosted by a cloud provider elsewhere in Canada or abroad.

A PIA must be proportionate to the sensitivity, quantity and intended use of the information. For a communication outside Quebec, it must show that the information will be adequately protected, and the communication must be covered by a written agreement.

5. Get valid consent

Consent must be manifest, free and informed, and given for specific purposes. It must be requested for each of those purposes, in clear and simple terms. For sensitive information (health, financial or biometric data, for example), consent must be express.

In practice, that means reviewing your forms, contracts and hiring processes. A pre-checked box or a clause buried in general terms and conditions is no longer enough.

6. Privacy by default and profiling technologies

If you offer the public a technology product or service with privacy settings, those settings must provide the highest level of confidentiality by default, without any action from the user.

If you use technology that can identify, locate or profile someone, such as certain tracking tools on a website, you must tell the person and explain how to activate those functions.

7. Automated decisions

If you make a decision based exclusively on automated processing of personal information (credit refused by software, job applications sorted automatically), you must inform the person. On request, you must explain the personal information used and the main factors behind the decision, and let the person submit observations to a member of your staff.

8. Retain, destroy or anonymize

Once the purpose for which personal information was collected has been achieved, it must be destroyed or anonymized. Anonymization must follow generally accepted best practices and make it irreversibly impossible to identify the person. Keeping years of old customer or former-employee files "just in case" is now a risk, not a precaution.

9. Individual rights: access, de-indexation and portability

People can ask to access and correct their personal information. They can also ask you to stop disseminating information about them or to de-index a hyperlink when dissemination causes them harm or breaks the law. Since 2024, they can ask for their computerized personal information to be sent to them, or to another organization, in a structured, commonly used format. Your business needs to know where that information lives to be able to respond.

Law 25 penalties

Law 25 gave privacy protection in Quebec real teeth:

• Administrative monetary penalties imposed by the CAI: up to $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater.
• Penal fines for businesses: from $15,000 up to $25 million or 4% of worldwide turnover, whichever is greater.
• Fines are doubled for repeat offences.

Beyond the amounts, a badly handled incident costs time, reputation and customer trust. For an SMB, the biggest risk is often having no plan when the incident happens.

Law 25 and cybersecurity: the IT side of compliance

Law 25 requires businesses to take reasonable security measures, suited to how sensitive the information is. Most of an SMB's personal information lives in its IT systems, so Law 25 compliance depends heavily on your IT.

Where does your personal information live?

You cannot protect what you have not mapped. In a typical SMB, personal information sits in:

• Microsoft 365: mailboxes, OneDrive, SharePoint and Teams;
• file shares on an office server or NAS;
• the CRM, accounting or payroll software and HR tools;
• employees' laptops and phones, sometimes personal ones;
• backups, which hold a copy of everything else.

The security measures that matter

• Access control: each employee only reaches what they need, and departing employees' accounts are closed the same day.
• Multi-factor authentication (MFA) on Microsoft 365, remote access and critical applications. It is the single measure that blocks most account takeovers.
• Encryption of laptops and mobile devices, managed with tools such as Microsoft 365 and Intune, so a lost device does not become a reportable incident.
• Logging: keep activity logs (sign-ins, file access) so you can reconstruct what happened during an incident.
• Protected, tested backups: immutable copies that ransomware cannot encrypt, and regular restore tests.
• Detection and response: 24/7 monitoring that catches an intrusion before personal information is stolen.
• Training: phishing is still the most common way in. Trained employees are your first line of defence.
• Retention and disposal: retention rules applied in Microsoft 365 and on servers, and secure disposal of old equipment.

Be ready for an incident

A one- or two-page incident response plan is often enough for an SMB: who to call, how to isolate a computer or account, who assesses the risk of serious injury, who notifies the CAI and the people affected, and how the incident is recorded in the register. The plan has to be known before an incident, not improvised during one.

If you outsource your IT, your provider handles personal information on your behalf. The law allows you to share it with them without consent, provided a written contract sets out the protection measures they must follow. You remain accountable, though, so make sure that contract exists.

Law 25 compliance checklist

Use this checklist to see where you stand. Every unchecked item is an action to plan.

• Designate the person in charge of personal information in writing, and publish their title and contact details on your website.
• Inventory the personal information you hold (customers, employees, suppliers) and the systems where it is stored.
• Write and publish your personal information governance policies in clear, simple terms.
• Publish a privacy policy if you collect information through a website, form or app.
• Create a confidentiality incident register, even if it is empty for now.
• Write an incident procedure: who assesses the risk of serious injury, who notifies the CAI and the people affected.
• Review your forms and consent requests: one specific purpose per request, clear wording, express consent for sensitive information.
• Set your technology products and services to the highest privacy level by default.
• Check your website's tracking tools and how visitors are informed and can activate them.
• Run a PIA before any new system that handles personal information and before any communication outside Quebec.
• Sign a written agreement with each provider that handles personal information for you (IT, payroll, CRM, cloud).
• Set retention periods, then destroy or anonymize what you no longer need.
• Limit access to what each person needs and turn on multi-factor authentication wherever possible.
• Encrypt laptops and mobile devices, and test restoring your backups.
• Train your employees on Law 25 and on spotting phishing.
• Prepare how you will answer access, correction, de-indexation and portability requests.

Where to start

If the list feels long, work in three steps:

• The legal basics: designate the person in charge, create the incident register and publish your policies. These are the most visible obligations, the first ones a customer or the CAI will check.
• The risk picture: inventory your information and systems, and find the gaps (overly broad access, no MFA, untested backups, data kept for no reason).
• Fixes and follow-up: close the gaps in order of risk, train your team, and review everything at least once a year or with every new project.

FAQ

Does Law 25 apply to small businesses?

Yes, Law 25 applies to every business that holds personal information in Quebec, whatever its size. A five-person company also needs a person in charge, an incident register and published policies. The measures must be proportionate, though: a small business does not need the same setup as a bank.

Who should be the person in charge of personal information?

By default, it is the person with the highest authority in the business. They can delegate the role in writing to an employee who knows the company's operations and systems well. The person's title and contact details must appear on your website.

What should we do if an employee emails personal information to the wrong person?

It is a confidentiality incident and it must be recorded in the register. First limit the damage, for example by asking the recipient to delete the message. Then assess whether it presents a risk of serious injury; if it does, notify the CAI and the people affected.

Can our data be hosted outside Quebec, for example in Microsoft 365?

Yes, Law 25 does not prohibit hosting outside Quebec. Before communicating personal information outside the province, however, you must run a privacy impact assessment showing it will be adequately protected, and cover the communication with a written agreement. Also check your data's hosting region and your Microsoft 365 tenant's security settings.

What are the fines under Law 25?

CAI administrative penalties can reach $10 million or 2% of worldwide turnover. Penal fines for a business range from $15,000 to $25 million or 4% of worldwide turnover, whichever is greater, and double for repeat offences.

Do we need a cookie banner on our website?

If your website uses tools that can identify, locate or profile visitors, Law 25 requires you to tell them and explain how to activate those functions. In practice, many businesses use a banner that lets visitors accept or refuse non-essential cookies. Have your setup reviewed based on the tools you actually use.

Is our IT provider covered by Law 25?

Your IT provider handles personal information on your behalf, but your business remains accountable. The law requires a written contract setting out the protection measures the provider must follow. A good IT provider also helps you put the technical measures in place: MFA, encryption, logging, backups and incident response.

How long does it take to comply with Law 25?

It depends on how much personal information you hold and how sensitive it is. For an SMB, the first steps (person in charge, register, policies) can often be done quickly. The data inventory, PIAs and security fixes take longer and are best planned over several months.

This guide gives a general overview of Law 25 and is not legal advice. For your specific situation, consult a lawyer.

Get a picture of your Law 25 compliance

Nexxo helps Quebec businesses comply with Law 25: compliance audits and gap analysis, policy development, privacy impact assessments, employee training and ongoing monitoring. Our team also handles the technical side through cybersecurity services: MFA, encryption, protected backups and 24/7 monitoring. Learn about our private data compliance service or our Law 25 compliance services in Montreal, and request a free assessment. To go further, read how AI can automate part of Law 25 compliance.