Quebec's Law 25: what a service business must do, section by section
Law 25 requires any Quebec business that holds customer information to have a privacy officer, publish their contact details, inform customers at collection, assess privacy before adopting a system or sending data outside Quebec, report certain incidents and destroy information it no longer needs. Size does not matter.
In short
- By default, the person with the highest authority in the business is responsible for protecting personal information.
- New software or a vendor outside Quebec calls for a privacy impact assessment.
- Every confidentiality incident goes in a register; those with a risk of serious injury are reported to the Commission d'accès à l'information.
- Administrative penalties can reach $10,000,000 or 2% of worldwide turnover, whichever is greater.
Does Law 25 apply to a small service business?
Yes. The law covers anyone carrying on an enterprise who holds personal information about others, whatever the size. A name, a phone number and a service address are enough.
Law 25 is the common name for the 2021 statute that modernized Quebec's Act respecting the protection of personal information in the private sector [1]. Its duties came into force in stages. According to the Commission d'accès à l'information (CAI), some rules have applied since September 2022, most since September 2023, and data portability since September 22, 2024 [2].
A landscaper, a physiotherapy clinic and a cleaning service all keep customer records: names, addresses, phone numbers, sometimes door codes or notes about the home. That is exactly what the law protects.
What are the key duties, at a glance?
| Section | Duty | What it means for you |
|---|---|---|
| 3.1 | Person in charge of protecting personal information | The owner by default; title and contact details published on the website |
| 3.2 | Governance policies | Written rules on retention, destruction, roles and complaints |
| 3.3 | Privacy impact assessment (PIA) | Before acquiring, developing or overhauling a system that handles personal information |
| 3.5 and 3.8 | Confidentiality incidents | Reduce the risk, keep a register, report cases with a risk of serious injury |
| 8 | Information at collection | Say why, how, which rights apply and how to withdraw consent |
| 12.1 | Automated decisions | Inform the person and let them be heard by someone who can review the decision |
| 17 | Communication outside Quebec | PIA and written agreement before sending personal information outside Quebec |
| 23 | Destruction or anonymization | Once the purpose is achieved, subject to any legal retention period |
Summary of the Act respecting the protection of personal information in the private sector [1]. The official text prevails.
Who is responsible for protecting personal information?
By default, the person with the highest authority in the business. They can delegate the role in writing, and their title and contact details must be published on the website.
Section 3.1 makes the business responsible for the personal information it holds and gives the role of privacy officer to the person with the highest authority, often the owner of a small business [1]. That person may delegate the role in writing, in whole or in part [1]. The CAI points out that the officer's title and contact details must be published on the business's website or, if there is none, made available by other appropriate means [3].
In a six-person company, the role often goes to whoever runs the office. Put the delegation in writing, date it, and add a dedicated email address to the privacy page of your website.
What must you tell customers when you collect their information?
Why you are collecting it, by what means, their rights of access and correction, and how to withdraw consent. Consent must be manifest, free, informed and given for specific purposes.
Section 8 requires you to tell people, at the time of collection, the purposes, the means used, their rights of access and correction, and their right to withdraw consent [1]. According to the CAI, consent must be manifest, free and informed, given for specific purposes and requested in plain language [2].
If you collect personal information by technological means, such as an online booking form, section 8.2 requires you to publish a privacy policy on your website, written in simple, clear terms [1].
What should you do before adopting software or a vendor?
A privacy impact assessment proportionate to the data and, if the data leaves Quebec, a second assessment plus a written agreement with the vendor.
Section 3.3 requires a PIA for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information [1]. The assessment must be proportionate to the sensitivity of the information, the purpose, the quantity, the distribution and the medium [1].
Section 17 adds that before communicating personal information outside Quebec, you must assess its sensitivity, the purpose, the protection measures, including contractual ones, and the legal framework of the destination, then sign a written agreement [1]. The CAI notes that a business that entrusts personal information to a service provider remains responsible for incident-related duties [4]. Our guide Choosing business management software lists the questions to ask.
What do you do after a confidentiality incident?
Reduce the risk right away, log the incident in the register and, if there is a risk of serious injury, notify the Commission d'accès à l'information and the people affected.
Examples of incidents: a technician's phone lost with access to customer files, or a customer list emailed to the wrong person. Section 3.5 requires reasonable measures to reduce the risk of injury and prevent a repeat [1]. If the risk of injury is serious, you must promptly notify the CAI and the people whose information is involved [1].
Section 3.8 requires a register of confidentiality incidents, provided to the Commission on request [1]. The CAI specifies that the register also covers incidents that do not present a risk of serious injury [4].
How long can you keep customer information?
As long as it serves the purposes it was collected for. After that, destroy or anonymize it, unless another law sets a retention period.
Section 23 requires you to destroy or anonymize personal information once the purposes for which it was collected or used have been achieved, subject to any retention period set by law [1]. A former customer's door code has no reason to stay in your files.
What penalties can a business face?
The Commission can impose administrative penalties of up to $10,000,000 or 2% of worldwide turnover, and courts can impose fines of $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.
Section 90.12 caps the administrative monetary penalty for a business at $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater [1]. Section 91 sets penal fines of $15,000 to $25,000,000 or 4% of worldwide turnover, including for failing to report an incident or to take the required security measures [1]. These are ceilings; actual amounts depend on the circumstances.
Where should you start to comply?
- 1
Designate the privacy officer
Confirm in writing who holds the role and publish their title and contact details on your website.
- 2
Inventory your information
List what you collect, where it is stored (software, cell phones, paper), who can access it and why.
- 3
Write your policies
Draft simple rules on retention, destruction and complaints; publish your privacy policy.
- 4
Assess your vendors
For each tool that handles personal information, do a proportionate PIA; add a written agreement if data leaves Quebec.
- 5
Open the incident register
Create the register today, even if it is empty, along with a one-page procedure for responding to an incident.
- 6
Clean house
Destroy information whose purposes have been achieved and that no law requires you to keep.
How does Law 25 affect automation and AI?
Mainly through three sections: the PIA before adopting a tool, section 17 if data leaves Quebec, and section 12.1 if a decision is based exclusively on automated processing.
A decision made by software with no human involvement, such as turning down a booking, can fall under section 12.1 [1]. The guide Human approval for AI agents explains how to keep a person in the loop. For emails and texts, Canada's Anti-Spam Legislation applies on top of Law 25: see Reduce no-shows.
For the big picture, read Automating a service business. In Pilotiko, AI agents prepare the work and a person approves anything touching a customer, money or an outgoing message; your hosted website can carry your privacy page. To compare plans, see pricing.
Frequently asked questions
Does a one-person business need a privacy officer?
Yes, but it happens automatically: the person with the highest authority holds the role. You still need to publish their title and contact details on the business website, or make them available another way if there is no website.
Do I need a privacy policy on my website?
If you collect personal information by technological means, such as a booking form, the law requires you to publish a privacy policy in simple, clear terms. Add the privacy officer's contact details there too.
What is a PIA in practice?
It is a document describing the personal information a project handles, the risks to people and the measures that reduce them. It must be proportionate, so for a small online calendar a few pages are often enough. The privacy officer must be consulted from the start.
Do I have to report a lost phone that holds customer files?
It always goes in the incident register. If it presents a risk of serious injury, for example because the files include door codes, you must notify the Commission and the people affected.
Can I use American booking software?
Yes, provided you complete the assessment required by section 17 and sign a written agreement that reflects its results. Ask the vendor where the data is hosted and which protections apply.
Does Law 25 cover my employees' information?
Yes. It protects all personal information the business holds, including its staff's. The same rules on security, access and destruction apply.
Sources
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
- Commission d'accès à l'information du Québec, Principaux changements apportés par la Loi 25 (accessed on October 15, 2026).
- Commission d'accès à l'information du Québec, Responsabilité des entreprises : le responsable de la protection des renseignements personnels (accessed on October 15, 2026).
- Commission d'accès à l'information du Québec, Incidents de confidentialité et mesures de sécurité (entreprises) (accessed on October 15, 2026).
Read next
How to automate a service business in Quebec: the complete guide
Bookings, dispatch, follow-up, reminders, Law 25 and CASL: what a Quebec service business can automate, what should stay human, and where to start.
Human approval for AI agents: what a small business should sign off on
Which AI agent actions need sign-off, how to rank the risk, what Law 25 and Canada's AI code say, and how long review really takes in a small service business.
How to choose business management software for a service company
Weighted scoring, vendor questions, Law 25, data hosting and portability: a practical method for choosing management software for a Quebec service business.
How to reduce no-shows in a service business
What a missed appointment really costs, what research says about text reminders, when to send them and what CASL allows. A practical guide for service SMBs.