Law 25 · Protection of personal information
Law 25 compliance for Quebec SMBs
Law 25 applies to every private business in Quebec, with no size threshold. For an SMB, most of the work happens on the website: a published privacy policy, consent requested properly, a designated person in charge. That's the part we take care of.
Who does Law 25 apply to?
Law 25 — in full, the Act to modernize legislative provisions as regards the protection of personal information — covers every private business that operates in Quebec and collects personal information. There is no threshold: five employees or five hundred, the obligations are the same.
And “collecting personal information” goes well beyond a customer database. A contact form, a newsletter, an analytics tool that tracks your visitors: it all counts.
Its provisions came into force in stages, in September 2022, 2023 and 2024. All of them apply today.
What the law actually requires of a website
- A person in charge of the protection of personal information. By default, it's the person with the highest authority in the business. Their title and contact details must be published on your website.
- A privacy policy in clear and simple terms, easy to find: what you collect, why, who it's shared with, how long it's kept.
- Valid consent: manifest, free, informed, requested for a specific purpose and presented separately from everything else. A pre-checked box is not consent.
- Control over cookies. Those not strictly necessary for the website to function require prior consent, and refusing must be as easy as accepting.
- A register of confidentiality incidents, with notice to the Commission d'accès à l'information and to the people affected when there is a risk of serious injury.
- A privacy impact assessment before communicating personal information outside Quebec.
- Respect for individual rights: access, rectification, withdrawal of consent, de-indexing, and data portability since September 2024.
The four gaps we see most often
We reviewed the websites of some thirty SMBs in Vaudreuil-Soulanges and the surrounding area. Four situations come up almost every time:
- No privacy policy, or a policy copied from another website that describes practices the business doesn't actually have.
- A decorative cookie banner. It informs, but tracking cookies are set before the first click, and there is no button to refuse.
- Forms without consent. A contact or newsletter form that doesn't say what the information will be used for, or where to read the policy.
- No designated person in charge. The obligation has existed since 2022, but the name appears nowhere on the website.
None of these gaps is hard to fix. The hard part is knowing they're there.
What we do, and what we don't
We handle the technical implementation on your website, whether it runs on Odoo or WordPress:
- an audit of the existing site, with a written report of the gaps found;
- drafting and integrating your privacy policy, which you approve in writing before it goes live;
- the cookie consent banner, with refusing as accessible as accepting and no cookie set before the visitor chooses;
- the consent box on your forms, not pre-checked, with a link to the policy.
We are not lawyers and we do not give legal advice. For a reading of your particular situation — an incident register, a privacy impact assessment, an agreement with a foreign provider — consult a legal advisor. We take care of what gets coded and what shows on your website.
If your data is hosted outside Quebec, the question deserves to be asked before anything else: what Law 25 really says about hosting.
Our Law 25 packages
Law 25 — Complete package
Everything you need to make your website compliant, at a fixed price. Combines the internal audit, the privacy policy, the cookie banner and the forms.
Request a quote- Complete internal audit
- Privacy policy drafted and integrated
- Compliant consent banner, refusing as visible as accepting
- Consent box on your forms
- Save $75 compared with individual services
Law 25 — Internal audit
What the free scan can't see: the actual content of your policy, the written designation of the person in charge, your incident register, your subcontracting agreements and your retention periods.
Request a quote- Policy checked against the requirements of section 8
- Incident register and its eight mandatory elements
- Subcontractor agreements and retention periods
- Need for a privacy impact assessment
- Written report, fixes ranked by priority
Law 25 — Privacy policy
Drafting of a privacy policy template customized to your business, then integration into your website.
Request a quote- Policy adapted to your activities
- Page published on your website
- Content approved in writing before publication
- Compatible with Odoo and WordPress
Law 25 — Cookie consent banner
Technical implementation of a cookie consent management banner, compliant with the requirements of Law 25.
Request a quote- Refusing as easy as accepting
- No cookie set before consent
- Visitor's choice remembered
- Compatible with Odoo and WordPress
Law 25 — Consent form
Adding a consent checkbox, not pre-checked, to your website's forms, with a link to your privacy policy.
Request a quote- Unchecked box on every form
- Direct link to the privacy policy
- Proof of consent kept
Law 25 — Monthly monitoring
Every month, we run your website through the scanner again and give you a timestamped report. That's what documents an ongoing compliance effort.
Request a quote- Monthly re-scan: trackers, third-party cookies, banner fairness
- Check that your “Refuse” button still works
- Timestamped report, kept as proof of good faith
- Alert if an update reintroduces a tracker
Where to start?
With the scan, and it's free. We open your website in a real browser and measure what loads before your visitor has consented: trackers, third-party cookies, and whether your “Refuse” button actually works. You receive a table with the section of the law that applies to each finding, within 24 business hours.
No commitment, no credit card. What gets billed afterwards is the internal audit — incident register, policy content, subcontracting agreements — because none of that can be seen from the outside.