Quebec Law 25 Compliance: Where Businesses Should Start

Since Quebec modernized its privacy rules, many business owners have felt the same way: they know Law 25 applies to them, but they are not sure what to do first. Some publish a privacy policy or add a cookie banner and assume the work is done. In practice, Quebec Law 25 compliance is broader than a single page or a pop-up. It touches how your business collects, uses, stores, shares, and destroys personal information, including the information that flows through your website and marketing tools every day.

At WSI Digital Marketing in Montreal, we help businesses assess and improve the digital and website-related parts of their privacy programs. This article explains what the law requires, where to begin, and how these obligations connect to the tools you already use.

What Is Quebec’s Law 25?

“Law 25” is the Act to modernize legislative provisions as regards the protection of personal information (formerly Bill 64). The law’s purpose is to give individuals more control over their personal information and to hold organizations to a higher standard when they handle it.

Personal information means any information relating to a natural person that allows that person to be identified, directly or indirectly. Its requirements were phased in on September 22 of 2022, 2023, and 2024, so all of the main obligations are now in force. Our Law 25 implementation overview walks through each phase if you want a closer look at how the rules were introduced.

Which Businesses Must Comply With Law 25?

The law applies to any person or organization carrying on an enterprise in Quebec that collects, holds, uses, or communicates personal information about others. There is no small-business exemption. A two-person shop, a growing SME, and a large corporation are all covered when they handle personal information.

Location is not the deciding factor either, since what triggers the law is carrying on an enterprise rather than where your office happens to be. A business based outside Quebec can still be covered when it handles the personal information of people in Quebec, for example by selling goods or services to Quebec customers, though whether that applies to a particular out-of-province business depends on its activities.

Size changes what a reasonable effort looks like. The law ties obligations to the nature and scope of your activities and the sensitivity of the information, but it does not remove them. If you have a customer list, a contact form, or a payroll file, the law is relevant to you. For a legal view, Montreal law firm Paquette Attorneys explains what Law 25 means for Quebec SMEs and why professional legal advice is worth seeking.

What Are the Main Law 25 Requirements?

The following obligations are set out in the legislation. How each applies in detail depends on your organization, which is one reason legal advice is valuable.

Assigning responsibility for personal information

Every organization must have a person in charge of protecting personal information. By default this is the person with the highest authority, but the role can be delegated in writing. Their title and contact information must be published on your website.

Establishing privacy governance policies

Businesses must adopt governance policies and practices covering the retention and destruction of information, staff roles across the information’s life cycle, and a process for handling complaints. Detailed information about them must be published in clear, simple language.

Obtaining valid consent

Consent must be clear, free, and informed, and requested for each specific purpose in plain language. For sensitive information, consent must be expressed. Individuals also keep the right to withdraw consent.

Conducting privacy impact assessments

A privacy impact assessment (PIA) is required for any project to acquire, develop, or overhaul an information system or electronic service-delivery system involving personal information, and before communicating personal information outside Quebec.

Managing confidentiality incidents

If you have reason to believe a confidentiality incident (unauthorized access, use, communication, or loss of personal information) has occurred, you must take reasonable steps to limit the risk. Where it presents a risk of serious injury, you must notify the Commission d’accès à l’information (CAI) and the affected individuals. You must also keep a register of confidentiality incidents. The CAI publishes guidance for businesses on confidentiality incidents that sets out what the notices and the register must contain.

Responding to individual privacy requests

Individuals can access and correct their information, receive it in a portable format, and, in defined circumstances, request de-indexation or the cessation of dissemination of information about them. Written requests must generally be answered within 30 days.

Establishing retention and destruction procedures

Once the purpose for collecting information is achieved, you must destroy it or anonymize it for serious and legitimate purposes, subject to any legal retention period. Anonymization must follow the criteria set out in Quebec’s regulations.

Reviewing transfers and providers outside Quebec

Before sending personal information outside Quebec, including to a service provider or cloud host, you must conduct a PIA and put a written agreement in place.

How Law 25 Affects Websites and Digital Marketing

This is where the law meets the tools our clients use every day. Personal information is routinely collected through ordinary marketing activity, often without anyone thinking of it as “data collection.”

Consider a typical business website. Contact forms, quote-request forms, and job application forms collect names, emails, and sometimes sensitive details. Newsletter subscriptions capture email addresses for future prospects. Google Analytics, Google Ads conversion tracking, the Meta Pixel, and the LinkedIn Insight Tag collect behavioural data, often for remarketing and retargeting. Chatbots, embedded videos, social media integrations, third-party plugins, and online appointment systems can each set cookies or send data to outside parties. Behind the scenes, your CRM, email marketing platform, customer databases, website hosting, and cloud storage all hold personal information, and some run on servers outside Quebec.

The practical takeaway is to understand, for each system, a short list of facts: what personal information it collects, why, how it is used, where it is stored, who can access it, and whether it is shared with third parties. On an e-commerce website, that list is longer and often includes payment and shipping details. This mapping underpins nearly every other obligation, from consent to incident response.

Why Cookie Consent Management Matters

A common misconception is that installing a cookie banner makes a website compliant. It does not. A banner is only useful if it reflects what your site actually does.

Under Law 25, a business should be able to answer several questions about its own website:

• Which cookies and tracking technologies are active?
• Which are essential, and which are non-essential?
• What does each one collect, and why?
• Which third parties receive this information?
• Is any of it processed or stored outside Quebec?
• Is valid consent required?
• Can visitors withdraw or change their consent?
• Most importantly, does the website actually behave according to each visitor’s choices?

One nuance is worth knowing: the requirement to set the highest privacy level by default does not apply to browser cookies, but the broader rules on consent, transparency, and technologies that identify, locate, or profile a person still shape how tracking should be handled.

A properly configured consent management platform can help.

Depending on the tool, it may:

• Scan your website for cookies and scripts
• Categorize them
• Block certain non-essential technologies before consent is given
• Display a consent notice
• Record user preferences
• Allow users to change or withdraw their consent
• Maintain documentation
• Update your cookie declaration
• Support multiple languages
• Integrate with analytics and advertising platform.

Our guide to cookie consent management covers what to look for when choosing a cookie consent management platform.

Two cautions matter.

First, do not choose a platform simply because it shows a banner; it should be configured, reviewed, and tested so the tracking on your site genuinely responds to each visitor’s selections.

Second, a consent platform is one component of a broader program. It does not replace legal advice, internal privacy policies, employee training, data inventories, retention and destruction procedures, privacy impact assessments, incident-response plans, vendor reviews, sound data security, or documentation of your privacy decisions.

Where Should Your Business Start?

If you have not yet worked through Law 25, this sequence is a practical starting point:

• Appoint or confirm the person responsible for protecting personal information, and publish their contact details
• Create an inventory of the personal information your business holds
• Map how that information is collected, used, stored, disclosed, and destroyed
• Review website forms, cookies, analytics, advertising pixels, and tracking scripts
• Review your privacy policy and consent language for clarity and accuracy
• Establish retention and destruction procedures
• Create a confidentiality incident response plan
• Maintain a confidentiality incident register
• Review service providers, hosting platforms, and technology vendors
• Conduct privacy impact assessments where required
• Review how personal information is transferred to or stored outside Quebec
• Train employees on their privacy responsibilities
• Document your decisions and compliance activities
• Coordinate legal, IT, cybersecurity, and digital marketing expertise where appropriate

For the technology and cybersecurity side of this work, including encryption, access controls, audits, and incident readiness, this Law 25 compliance checklist from Info-Tech Montreal, a trusted Montreal IT firm, offers additional practical detail that complements the information shared in our article.

Law 25 Compliance Is an Ongoing Process

Compliance is not a project you finish once. Your technologies, vendors, data practices, and operations change, and regulatory guidance evolves alongside them. Adding a new analytics tool, advertising platform, CRM, chatbot, or third-party integration can change what you collect, so each addition deserves a fresh privacy review. Building a habit of periodic review is far easier than reconstructing your data practices after the fact.

Frequently Asked Questions About Law 25

Does Law 25 apply to small businesses? Yes. There is no exemption based on size, though what counts as reasonable effort scales with your activities.

Does my website need a cookie consent banner? Yes, in practice most business websites do. If your site runs analytics, advertising pixels, or other non-essential tracking, you have to tell visitors about it and obtain valid consent, and a consent banner is the standard way to do that. The banner still has to reflect your actual tracking and respect visitors’ choices, since the banner by itself is not what creates compliance.

Is Google Analytics affected by Law 25? Yes. It collects visitor information and may involve third parties and cross-border data flows, so review it for consent, transparency, and your privacy policy.

Does a consent management platform guarantee compliance? No. It can support consent and transparency but is one part of a broader program; it does not replace legal advice, policies, training, or security.

Who should be responsible for protecting personal information? By default, the person with the highest authority. The role can be delegated in writing, and the person’s contact information must be published.

When is a privacy impact assessment required? Before acquiring, developing, or overhauling an information system involving personal information, and before communicating personal information outside Quebec, among other cases.

Conclusion

Quebec Law 25 compliance can feel daunting, but you do not have to solve every legal and technical question at once. The most useful first move is to understand your own data practices, including what you collect, why, where it lives, and who can reach it, before bringing in the right expertise to close the gaps.

WSI Digital Marketing Montreal can help with the digital and website side of that effort: consent management platform implementation, consent-banner configuration, privacy-policy placement, contact-form and newsletter form reviews, analytics and advertising script reviews, third-party plugin reviews, and website tracking audits. We also coordinate with your legal, IT, and cybersecurity professionals so the pieces fit together.

Ready to review the website, cookie, analytics, and tracking side of your privacy program?

Contact WSI Digital Marketing Montreal to talk it through.

This article is provided for general information only and is not legal advice. Law 25 can apply differently depending on your organization’s activities, technologies, and use of personal information. For your specific obligations, consult a qualified legal professional. WSI Digital Marketing Montreal does not provide legal advice, certify or guarantee compliance, or replace a lawyer, privacy professional, IT provider, or cybersecurity specialist.