Law 25 & your website: the Quebec compliance checklist

If you do business in Quebec, Law 25 (formerly Bill 64) applies to you — and your website is on the front line. The law modernized Quebec's privacy rules; most obligations have been in force since September 2023, with data portability added in 2024. Here's what it means for your website, in plain language, plus a practical checklist to get compliant.

This is general information, not legal advice. For your specific situation, consult a qualified professional.

Who does Law 25 apply to?

Essentially every private-sector business operating in Quebec that collects personal information — names, emails, phone numbers, even data from a contact form or analytics. Size doesn't exempt you: a small clinic or contractor is covered just like a large company.

What counts as personal information?

• Names, emails, phone numbers and addresses.
• Contact-form submissions and quote requests.
• Analytics and cookies that can identify a person.
• Health, financial or other sensitive data (extra obligations apply).

Your Law 25 website checklist

1. Appoint a Privacy Officer. By default it's the highest-ranking person in the business; name them and publish their contact details.
2. Publish a clear privacy policy. What you collect, why, how long you keep it, who it's shared with, and how to exercise rights.
3. Get valid consent. Consent must be clear, free and informed — and specific for sensitive data.
4. Cookie and tracking consent. Non-essential cookies and trackers (analytics, ads) need consent; offer a real choice.
5. Privacy by default. Collect only what you need; don't pre-check boxes or over-collect.
6. Honour individual rights. Access, correction, deletion and data portability on request.
7. Have a breach process. Report incidents posing serious risk to the Commission d'accès à l'information and to affected people.
8. Vendor and transfer checks. Know where data goes (hosting, forms, email) and assess transfers outside Quebec.

What about penalties?

They're serious. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines up to $25 million or 4% of worldwide turnover — whichever is higher. Beyond fines, non-compliance erodes the trust your customers place in you.

The website-specific essentials

• Privacy policy linked in your footer, written plainly.
• Cookie consent banner with a genuine choice for non-essential trackers.
• Forms that collect only what's needed, with the purpose stated.
• Secure hosting and HTTPS across the whole site.
• A clear way to contact your Privacy Officer and exercise rights.

For how trust and credibility drive results, see our business website guide.

Frequently asked questions

Does Law 25 apply to a small business website?

Yes. There's no size exemption. If your site collects any personal information — even just a contact form — you have obligations.

Do I really need a cookie banner?

If you use non-essential cookies or trackers (Google Analytics, ad pixels, etc.), you must inform users and obtain consent. Strictly necessary cookies are treated differently.

Is a generic privacy policy enough?

No. It must reflect what your site actually collects and does, name your Privacy Officer, and explain how to exercise rights.

What's the fastest way to get compliant?

Start with the basics: privacy policy, cookie consent, minimal forms, a named Privacy Officer and a breach process. We build these into every website we deliver.

Not sure if your site is compliant? Ask for a Law 25 website check — we'll flag the gaps and fix them.