Quebec's Law 25 modernizes personal information protection. For an SMB, the message is simple: if you collect data about clients or employees, you have obligations: and they keep tightening over time.
Here's what Law 25 requires in practice.
Who does it apply to?
Almost any business that:
- keeps client email, phone, or address in a file ;
- runs a website with a contact form ;
- employs people with HR records ;
- stores invoices or contracts digitally.
If you do business in Quebec, Law 25 applies: regardless of team size.
Core obligations
Privacy policy. Clients and employees should know what data you collect, why, and how long you keep it. On your website, that's the privacy page: French first.
Privacy officer. One designated person in the business (often the owner in an SMB) who answers privacy questions.
Reasonable security. Strong passwords, multi-factor authentication (MFA) on email and admin accounts, role-based access. This isn't optional: it's what "appropriate security measures" means in practice.
If something goes wrong. When personal information is exposed (ransomware, compromised email, stolen laptop), you must assess impact, log the incident in your register, and, depending on severity, notify the Commission d'accès à l'information (CAI) and affected individuals promptly.
The incident register
Law 25 expects you to keep a register of confidentiality incidents. Even the small ones: wrong recipient, access left open too long, stolen laptop. A simple Excel file is often enough.
Each row is one incident. Note the date (or approximate period), what happened, which personal information was involved and roughly how many people, your read on the risk, what you did to limit the damage, and whether the CAI and affected people were notified (yes, no, or not required).
Every incident goes in the register. You must also promptly notify the Commission d'accès à l'information (CAI), the body that oversees Law 25, and the people affected when there is a risk of serious injury. Assessing that risk is your call, ideally with your legal advisor. It isn't your IT provider's role. This is not legal advice, and we don't represent you before the CAI.
Keep each entry for at least five years after you learn of the incident. The CAI can ask you for a copy, and it explains all of this on its page about confidentiality incidents.
On the IT side, we can help detect what happened (compromised account, exposed mailbox, backup involved) and write down the technical facts. We do not certify your compliance.
What Law 25 doesn't always require
You don't need $50k software or a full annual audit on day one. You need to start: data inventory, locked-down access, tested backups, and a plan when things go wrong.
For deeper work, a paid Law 25 audit with a written report is an option: useful before growth or a large client contract.
IT and Law 25: the direct link
Your IT provider (or "computer guy") often touches personal data: email, M365 accounts, backups. Your service agreement should cover confidentiality and incident obligations.
At Atlas Numérique, Law 25 awareness is part of our standard practice. See our Law 25 compliance page for what we offer.
Start this week
- Confirm your site has an up-to-date privacy policy (French primary).
- Enable MFA on Microsoft 365: all accounts, especially admins.
- List who has access to what (email, shared drives, apps).
- Confirm backups work: and test a restore.