Quebec's Law 25: What Website Owners Must Do

If your business serves customers in Quebec, you need to know about Law 25, the province's modernised privacy legislation that was phased in across 2022 to 2024. It introduced obligations that go beyond PIPEDA, with real penalties. This is a plain-English summary, not legal advice, and Law 25 is detailed enough that professional guidance is worth it.

Why Law 25 matters even outside Quebec

Law 25 applies to organisations doing business in Quebec, not just those headquartered there. If you collect personal information from people in Quebec through your website, it can reach you. Given Quebec's population, many Canadian and international businesses fall in scope.

It is widely seen as Canada's closest equivalent to the EU's GDPR, so treating it as your high-water mark is sensible.

Key obligations

• Appoint a person responsible for protecting personal information, often a privacy officer.
• Report confidentiality incidents that pose a risk of serious injury to the regulator and affected people.
• Obtain clear consent and explain the purposes of collection.
• Provide privacy settings that default to the most protective option.
• Honour new rights, including data portability and, in many cases, deletion.
• Assess privacy impacts before certain projects and before some transfers outside Quebec.

What this means for your website

In practice, you need a thorough and current privacy policy, a clear consent mechanism, cookie controls that default to privacy, and a documented process for handling incidents and individual requests. If you use analytics or advertising trackers, treat consent seriously.

If you offer service in French to Quebec customers, your privacy information should be available in French too.

Where to start

Map what personal information your site collects and why, name someone responsible, update your privacy policy, and make sure your consent and cookie tools default to the protective setting. For transfers and impact assessments, get advice, since the details carry penalties if mishandled.