Quebec Privacy LawGuide for Small Business
The same gaps show up in business after business. Here's how to spot each one, and what fixing it actually involves.
· IT & cybersecurity for Quebec SMBs since 1995
Law 25 has been fully in force since September 2024, and CAI enforcement is no longer theoretical. In a May 2026 decision, the regulator ordered a property-management company to overhaul its practices within 30 days after finding several of the exact gaps below. None of them are exotic. They're the basics, skipped.
By default, the person responsible for protecting personal information is the most senior person in your organization. Most owners don't realize they already hold the role, and almost none have published the title and contact information, which Law 25 requires. It's the first thing the CAI checks in any complaint, and it was one of the findings in the May 2026 decision above.
The fix: decide who owns the role (the owner or a senior manager is fine), document the assignment, and publish the title and a contact method on your website or privacy policy. An hour of work, and you're compliant on the single most-checked item.
A confidentiality incident isn't just a hack. It's a lost laptop, an email sent to the wrong client, a phishing compromise of one mailbox. Law 25 requires every incident to be logged internally, even the minor ones, and the CAI can ask for the register during an investigation. A business with no register looks like a business that's never paid attention.
The fix: a simple spreadsheet with date, what happened, what information was involved, severity assessment, and what you did about it. Start it today with any incidents you remember; keep it current from now on.
Pre-checked boxes, a blanket “I agree” covering ten unrelated uses, marketing consent hidden on page 14 of your terms: none of it holds up anymore. Consent has to be specific to its purpose, separate from your general terms, and easy to withdraw. Sensitive information, like health or financial details, needs express consent on top of that.
The fix: review every place you ask for consent (web forms, contracts, intake paperwork) and split each purpose into its own clear yes. While you're there, check your website's cookie banner: analytics and tracking need to stay off until the visitor opts in.
Your payroll provider, cloud storage, POS system, and HR software all process personal information on your behalf, and you stay responsible for what happens to it. Contracts signed years ago rarely say anything about privacy obligations, security measures, or notifying you when the vendor has an incident.
The fix: list every vendor that touches personal information, find out where each one stores and processes data, and get privacy and breach-notification obligations into the contract at renewal. For major SaaS vendors, their standard data-processing terms often cover this; you just need to confirm and file them.
A privacy impact assessment is required before you acquire or significantly redesign any system that handles personal information, and before personal information leaves Quebec, which includes cloud services hosted elsewhere in Canada or the US. Most SMBs adopt new tools without one, which means most SMBs are quietly non-compliant every time they switch platforms.
The fix: a PIA for a typical SMB tool doesn't need to be long. What information is involved, who has access, where it's stored, what the risks are, and how they're mitigated, on a few pages, dated and filed. Build the template once and reuse it for every new system.
All five fixes together are days of effort, not months, and they cover the items the CAI checks first. Run through the full 10-section checklist to see what else applies to you, or take the 5-minute self-assessment for a prioritized read on your gaps.