Quebec Law 25: what changed for small businesses?
A faithful summary of the main obligations, with the sections to read. This is general information, not legal advice.
Law 25 is the Quebec statute adopted in 2021 that modernized privacy rules, including the Act respecting the protection of personal information in the private sector. It requires businesses to have a person in charge of personal information, obtain clear consent, report serious confidentiality incidents and be more transparent about what they collect.
In short
- By default, the person with the highest authority is in charge (s. 3.1).
- Consent must be manifest, free, enlightened and given for specific purposes (s. 14).
- Incidents with a risk of serious injury must be reported (s. 3.5).
- Administrative penalties reach $10M or 2% of worldwide turnover (s. 90.12).
What is Law 25?
Law 25 is the common name for the 2021 statute (S.Q. 2021, chapter 25) that amended Quebec's privacy laws. The Commission d'accès à l'information groups its changes by theme and shows they came into force in stages, including September 2022 and September 2023 [2].
For a private business, the text to read is the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1); many of its sections carry the note 2021, c. 25 [1]. A small business in snow removal that keeps names, addresses and phone numbers is covered just like a large corporation.
What are the main obligations?
| Obligation | Where to read it | What it means in practice |
|---|---|---|
| Person in charge of protecting personal information | s. 3.1 | By default the person with the highest authority; title and contact details published on the website |
| Confidentiality incident | s. 3.5 | Reduce the risk; notify the Commission and the people affected if there's a risk of serious injury |
| Consent | s. 14 | Manifest, free, enlightened, for specific purposes, in simple and clear terms |
| Automated decision | s. 12.1 | Tell people about a decision based exclusively on automated processing |
| Privacy policy | Commission's Law 25 page | Plain-language policy on your website when you collect information by technological means |
| Privacy impact assessment | Commission's Law 25 page | Before an information-system project involving personal information |
Sources: CQLR c. P-39.1 and the Commission d'accès à l'information page on the main Law 25 changes (in French).
Who is in charge in a small business?
Section 3.1 is plain: anyone carrying on an enterprise is responsible for protecting the personal information it holds, and the person exercising the highest authority acts as the person in charge. That role can be delegated in writing, in whole or in part, and the title and contact information of the person in charge must be published on the enterprise's website [1].
In a six-person company, that is usually the owner, unless the role is delegated in writing to someone else.
What do you do after a confidentiality incident?
Under section 3.5, a business that has cause to believe an incident occurred must take reasonable measures to reduce the risk of injury and prevent it happening again. If the incident presents a risk of serious injury, it must promptly notify the Commission d'accès à l'information and the people whose information is involved [1].
A concrete case: an unlocked job-site phone holding the customer list and their door codes goes missing. You assess the risk, act to contain it, then decide whether notification is required.
Where should you start, in hours of work?
What are the penalties?
Section 90.12 caps monetary administrative penalties at $50,000 for an individual and, in other cases, at $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater [1].
For penal offences, section 91 sets fines of $5,000 to $100,000 for an individual and, in other cases, $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater [1].
Which mistakes do small businesses make?
- Assuming the law only targets large companies.
- Burying consent in long terms and conditions, when a written request must be presented separately from other information.
- Keeping customer files in information systems nobody has inventoried: phones, spreadsheets, inboxes.
- Confusing Law 25 with CASL: one protects personal information, the other governs commercial messages.
- Copying another site's privacy policy without matching it to what you actually collect, for example in your CRM.
How does Pilotiko approach automated decisions?
Section 12.1 covers decisions based exclusively on automated processing of personal information: the business must inform the person no later than when it informs them of the decision [1].
In Pilotiko, AI agents prepare the work, but anything touching a customer, money or a send waits for a person's approval; that's the human-in-the-loop principle. It doesn't replace your own obligations: using software does not discharge them.
Frequently asked questions
Does Law 25 apply to small businesses?
Yes. It applies to anyone carrying on an enterprise who holds personal information, with no size threshold. The obligations are the same; how you implement them can be proportionate.
Who should be the person in charge of personal information?
By default, the person with the highest authority in the business. The role can be delegated in writing, and the title and contact details must be published on the website.
Do I need a privacy policy on my website?
According to the Commission d'accès à l'information, organizations that collect personal information by technological means must publish a privacy policy in simple, clear terms and give notice of changes.
What should I do after a data breach?
Take reasonable measures to reduce the risk and prevent a repeat. If there is a risk of serious injury, promptly notify the Commission and the people affected.
What is the maximum Law 25 penalty?
For a business, administrative penalties can reach $10 million or 2% of worldwide turnover, and penal fines $25 million or 4%, whichever is greater. Read sections 90.12 and 91 for details.
Sources
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
- Commission d'accès à l'information du Québec, Principaux changements apportés par la Loi 25 (accessed on October 15, 2026).
Read next
CASL: what does Canada's anti-spam law allow?
CASL for small businesses: express vs implied consent, the 2-year and 6-month windows, 10 business days to unsubscribe, key exceptions and penalties.
What does human-in-the-loop mean?
Human-in-the-loop puts a person before an AI's sensitive actions. Forms of oversight, Quebec and Canadian rules, a worked SME example and the mistakes to avoid.
What is CRM (customer relationship management)?
What CRM means, what CRM software actually holds, a follow-up calculation for a Quebec service business, and the privacy duties Quebec's Law 25 adds.
What is an information system (IS)?
What an information system is for a small business: hardware, software and people, how it differs from IT, a quick inventory example and Quebec privacy duties.