Quebec Privacy LawGuide for Small Business
A few extra resources to help you put Law 25 into practice, including a printable version of the compliance checklist.
· IT & cybersecurity for Quebec SMBs since 1995
A printable, fillable version of the 10-section checklist, with checkboxes for Yes, No, or Planned and fillable fields for who’s responsible and your target date.
We’ll use this to send you the checklist, and MTech Cyber may follow up by email to see if you’d like help closing your compliance gaps. No spam, and you can opt out any time. See our Privacy Policy.
A walkthrough of the ten areas the CAI expects every business to have covered, with practical first steps for each one. Useful if you’re starting from scratch and don’t know where to begin.
Read the checklist →The same gaps show up again and again: no designated privacy officer, no incident register, consent buried in terms of service, vendor contracts that haven’t been updated in years, and PIAs skipped entirely when moving to a new cloud platform. Here’s how to spot and fix each one.
Read the article →The first 48 hours after discovering a confidentiality incident matter. This covers how to assess whether an incident poses a serious risk of harm, who to notify, what to document, and how to update your incident register so you’re ready if the CAI ever asks.
Read the article →This guide is a plain-language starting point. For the law itself and regulator guidance, go straight to the source:
Quebec’s privacy regulator: guidance, forms for reporting confidentiality incidents, and biometric system declarations.
cai.gouv.qc.ca →The Act respecting the protection of personal information in the private sector, as amended by Law 25, on LégisQuébec.
Read the Act →Published decisions from the CAI’s oversight section, useful for seeing what enforcement actually looks like in practice.
Browse decisions →Federal guidance under PIPEDA, relevant if you do business outside Quebec or in federally regulated sectors.
priv.gc.ca →