Compliance Checklist

The Law 25 Compliance Checklist

Ten areas the CAI expects every business to have covered, including a few that have nothing to do with your website. Sections below are ordered by the Law 25 phase that introduced them. Work through each one, check off what you already have in place, and use the “why it matters” notes to prioritize what’s left.

Take the Compliance Assessment

Phase 1

September 22, 2022

Governance and incident response

Phase 2

September 22, 2023

Policies, consent, and assessments

Phase 3

September 22, 2024

Data portability

1. Privacy Officer

Phase 1 · Completed by September 22, 2022

Goal: designate and publish a point of contact

A specific person (or role) is designated as responsible for protecting personal information

By default, this is your most senior person, unless the role has been formally delegated.

The title and contact information for this role are published, e.g. on your website or privacy policy

Why it matters: this is the first thing the CAI looks for in any complaint or investigation. Without a named, published privacy officer, you’re non-compliant on the most basic requirement of Law 25.

2. Incident Register & Breach Response

Phase 1 · Completed by September 22, 2022

Goal: track and respond to confidentiality incidents

An internal register logs every confidentiality incident, even minor ones

A process exists to assess whether an incident poses a serious risk of harm

Incidents with a serious risk of harm are reported to the CAI and affected individuals without delay

Why it matters: a breach is usually how Law 25 gaps get discovered in the first place. An incident register and a clear response process turn a bad day into a documented, defensible one.

3. Governance & Privacy Policy

Phase 2 · Completed by September 22, 2023

Goal: govern how you handle personal information internally, and tell people what you collect and why

Your organization has an internal governance policy for how personal information is handled throughout its lifecycle, approved by whoever is most senior in the organization (a real document, not just something posted on your website)

A privacy policy is published and describes what personal information is collected and why

Clear notice is given at the point of collection (forms, sign-up pages, contracts, and in-person or paper intake)

The policy explains how individuals can exercise their rights (access, correction, withdrawal of consent)

Why it matters: the CAI has been auditing businesses’ internal governance policies, not just their published privacy notices. In a May 2026 decision, the CAI cited a property-management company for having neither. Transparency requirements are checked early in any review, and a missing governance policy or an outdated privacy policy are both easy gaps for a regulator to spot.

4. Consent Management

Phase 2 · Completed by September 22, 2023

Goal: get clear, informed consent for collection and use

Consent requests are separate from terms of service, written in plain language

Consent is specific to each purpose, not bundled into one blanket agreement

Individuals can withdraw consent, and there’s a process to act on that

Why it matters: Law 25 raised the bar on what counts as valid consent. Pre-checked boxes and buried clauses in a 20-page terms document no longer hold up.

5. Data Minimization & Retention

Phase 2 · Completed by September 22, 2023

Goal: collect only what you need, keep it only as long as needed

Data collection forms and intake processes (web forms, paper intake, HR onboarding, POS and in-person registration) are reviewed and trimmed to what's actually needed

Retention periods are defined for each major category of personal information

Data is securely destroyed or anonymized once it's no longer needed for its original purpose

Why it matters: every record you don't need is extra liability if there's ever a breach. This is also where the CAI looks first: collecting an ID number or SIN “just in case” instead of only when truly necessary is a common, enforceable gap; the same May 2026 CAI decision ordered improperly collected SINs destroyed within 30 days. Minimization and retention limits shrink your exposure and are explicitly required under Law 25.

6. Privacy Impact Assessments (PIAs)

Phase 2 · Completed by September 22, 2023

Goal: assess privacy risk before major changes

A PIA is completed before acquiring, developing, or significantly redesigning a system that handles personal information

A PIA is completed before transferring personal information outside Quebec, including elsewhere in Canada

PIA findings are documented and feed into project decisions, not just filed away

Why it matters: this is one of the most commonly missed requirements for SMBs, especially around cloud services and SaaS tools hosted outside Quebec. A simple PIA template can cover most situations.

7. Vendor & Third-Party Contracts

Phase 2 · Completed by September 22, 2023

Goal: make sure your vendors are bound by the same rules

Contracts with vendors who process personal information on your behalf (payroll providers, cloud storage, POS systems, HR or accounting software) include privacy and security obligations

You know where each vendor stores and processes data, including outside Quebec or Canada

Vendors are required to notify you of any confidentiality incident involving your data

Why it matters: you remain responsible for personal information even when a third party is handling it. Outdated or missing vendor contracts are a common gap uncovered during a PIA.

8. Security Safeguards

Phase 2 · Completed by September 22, 2023

Goal: protect personal information with safeguards appropriate to its sensitivity

Access to personal information (digital and paper) is limited to staff who need it for their role

Devices and systems holding personal information are protected with current security tools and patching

Backups of personal information exist and are tested, in case of ransomware or data loss

Why it matters: Law 25 requires “reasonable security measures” proportional to the sensitivity of the information. This is also where most confidentiality incidents originate, so it overlaps directly with your everyday IT security.

9. Automated Decision-Making & Biometrics

Phase 2 · Completed by September 22, 2023

Goal: know when these less obvious rules apply to you

If any decision about a customer or employee is made solely by automated processing (credit or eligibility scoring, résumé-screening software, an algorithm-driven risk score), the person is told this before or when the decision is made, and can ask for the reasons and a human review

Any biometric identification or authentication system (a fingerprint time clock, facial recognition access control, or a loss-prevention camera system) is declared to the CAI at least 60 days before it goes live, with its necessity and proportionality documented

Why it matters: these rules aren’t about websites at all. They cover HR software, time clocks, and security cameras that plenty of brick-and-mortar SMBs already use. The CAI has actively enforced both provisions in recent decisions, and the same penalties apply as for any other Law 25 requirement.

10. Data Subject Rights

Phase 3 · Completed by September 22, 2024

Goal: be ready to respond to access, correction, and portability requests

A process exists for individuals to request access to their personal information

A process exists for individuals to request corrections to inaccurate information

You can provide computerized personal information in a structured, commonly used format on request, and transfer it directly to another organization where technically feasible

Why it matters: these rights are now enforceable, and an SMB that takes weeks to even acknowledge a request is exposed if the requester escalates to the CAI.

The Law 25 Compliance Checklist

1. Privacy Officer

2. Incident Register & Breach Response

3. Governance & Privacy Policy

4. Consent Management

5. Data Minimization & Retention

6. Privacy Impact Assessments (PIAs)

7. Vendor & Third-Party Contracts

8. Security Safeguards

9. Automated Decision-Making & Biometrics

10. Data Subject Rights

Want Help Closing the Gaps?