Law 25 (An Act to modernize legislative provisions as regards the protection of personal information) applies to every business that collects personal information in Quebec. Almost every website does: a contact form, a newsletter, an analytics tool or an advertising pixel is enough.
1. A clear privacy policy
Your website must publish, in plain language, a policy explaining what information you collect, why, how it is protected, how long you keep it, and how a person can access or correct it.
2. The person in charge of protecting personal information
By default, this is the person with the highest authority in the business. Their title and contact information must be published on the website.
3. Cookie consent
Technologies that can identify, locate or profile a person must be turned off by default. In practice, Google Analytics, Meta or LinkedIn pixels and other tracking tools must wait for the visitor's consent. A banner that makes "Accept" and "Decline" equally easy is the recommended practice.
4. Forms that ask only for what you need
Only ask for information that is useful for the request. State the purpose of the collection near the form and link to your policy.
5. Where your data is hosted
Before sharing personal information outside Quebec (including with a cloud provider), the business must assess the privacy-related factors. Hosting in Canada with well-known providers makes that assessment simpler.
6. An incident register
Every confidentiality incident (a hack, a leaked customer list) must be recorded in a register and, if it presents a risk of serious injury, reported to the Commission d'accès à l'information and to the people concerned.
Quick checklist
- Privacy policy published and reachable from every page
- Person in charge of personal information named, with contact details
- Consent banner: tracking tools blocked until accepted
- Forms limited to what is strictly necessary, with the purpose stated
- Hosting and subcontractors documented
- Incident procedure and register
Every website we build includes these elements. Is your current site not compliant? A redesign or a simple upgrade can fix it.