# Quebec's Law 25: what a service business must do, section by section

> Privacy officer, consent, vendors, incidents, retention and penalties: Quebec's Law 25 explained section by section for small service businesses in Quebec.

Updated on October 15, 2026 · https://app.pilotiko.com/en/guides/quebec-law-25-for-service-businesses

Law 25 requires any Quebec business that holds customer information to have a privacy officer, publish their contact details, inform customers at collection, assess privacy before adopting a system or sending data outside Quebec, report certain incidents and destroy information it no longer needs. Size does not matter.

## In short
- By default, the person with the highest authority in the business is responsible for protecting personal information.
- New software or a vendor outside Quebec calls for a privacy impact assessment.
- Every confidentiality incident goes in a register; those with a risk of serious injury are reported to the Commission d'accès à l'information.
- Administrative penalties can reach $10,000,000 or 2% of worldwide turnover, whichever is greater.

## Does Law 25 apply to a small service business?

Yes. The law covers anyone carrying on an enterprise who holds personal information about others, whatever the size. A name, a phone number and a service address are enough.

Law 25 is the common name for the 2021 statute that modernized Quebec's Act respecting the protection of personal information in the private sector [1]. Its duties came into force in stages. According to the Commission d'accès à l'information (CAI), some rules have applied since September 2022, most since September 2023, and data portability since September 22, 2024 [2].

A landscaper, a physiotherapy clinic and a cleaning service all keep customer records: names, addresses, phone numbers, sometimes door codes or notes about the home. That is exactly what the law protects.

> This guide provides general information about the law as of October 15, 2026. It is not legal advice. For a specific situation, consult a lawyer or the Commission d'accès à l'information.

## What are the key duties, at a glance?

| Section | Duty | What it means for you |
|---|---|---|
| 3.1 | Person in charge of protecting personal information | The owner by default; title and contact details published on the website |
| 3.2 | Governance policies | Written rules on retention, destruction, roles and complaints |
| 3.3 | Privacy impact assessment (PIA) | Before acquiring, developing or overhauling a system that handles personal information |
| 3.5 and 3.8 | Confidentiality incidents | Reduce the risk, keep a register, report cases with a risk of serious injury |
| 8 | Information at collection | Say why, how, which rights apply and how to withdraw consent |
| 12.1 | Automated decisions | Inform the person and let them be heard by someone who can review the decision |
| 17 | Communication outside Quebec | PIA and written agreement before sending personal information outside Quebec |
| 23 | Destruction or anonymization | Once the purpose is achieved, subject to any legal retention period |

Summary of the Act respecting the protection of personal information in the private sector [1]. The official text prevails.

## Who is responsible for protecting personal information?

By default, the person with the highest authority in the business. They can delegate the role in writing, and their title and contact details must be published on the website.

Section 3.1 makes the business responsible for the personal information it holds and gives the role of privacy officer to the person with the highest authority, often the owner of a small business [1]. That person may delegate the role in writing, in whole or in part [1]. The CAI points out that the officer's title and contact details must be published on the business's website or, if there is none, made available by other appropriate means [3].

In a six-person company, the role often goes to whoever runs the office. Put the delegation in writing, date it, and add a dedicated email address to the privacy page of your website.

## What must you tell customers when you collect their information?

Why you are collecting it, by what means, their rights of access and correction, and how to withdraw consent. Consent must be manifest, free, informed and given for specific purposes.

Section 8 requires you to tell people, at the time of collection, the purposes, the means used, their rights of access and correction, and their right to withdraw consent [1]. According to the CAI, consent must be manifest, free and informed, given for specific purposes and requested in plain language [2].

If you collect personal information by technological means, such as an online booking form, section 8.2 requires you to publish a privacy policy on your website, written in simple, clear terms [1].

## What should you do before adopting software or a vendor?

A privacy impact assessment proportionate to the data and, if the data leaves Quebec, a second assessment plus a written agreement with the vendor.

Section 3.3 requires a PIA for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information [1]. The assessment must be proportionate to the sensitivity of the information, the purpose, the quantity, the distribution and the medium [1].

Section 17 adds that before communicating personal information outside Quebec, you must assess its sensitivity, the purpose, the protection measures, including contractual ones, and the legal framework of the destination, then sign a written agreement [1]. The CAI notes that a business that entrusts personal information to a service provider remains responsible for incident-related duties [4]. Our guide [Choosing business management software](https://app.pilotiko.com/en/guides/choose-business-management-software) lists the questions to ask.

## What do you do after a confidentiality incident?

Reduce the risk right away, log the incident in the register and, if there is a risk of serious injury, notify the Commission d'accès à l'information and the people affected.

Examples of incidents: a technician's phone lost with access to customer files, or a customer list emailed to the wrong person. Section 3.5 requires reasonable measures to reduce the risk of injury and prevent a repeat [1]. If the risk of injury is serious, you must promptly notify the CAI and the people whose information is involved [1].

Section 3.8 requires a register of confidentiality incidents, provided to the Commission on request [1]. The CAI specifies that the register also covers incidents that do not present a risk of serious injury [4].

## How long can you keep customer information?

As long as it serves the purposes it was collected for. After that, destroy or anonymize it, unless another law sets a retention period.

Section 23 requires you to destroy or anonymize personal information once the purposes for which it was collected or used have been achieved, subject to any retention period set by law [1]. A former customer's door code has no reason to stay in your files.

## What penalties can a business face?

The Commission can impose administrative penalties of up to $10,000,000 or 2% of worldwide turnover, and courts can impose fines of $15,000 to $25,000,000 or 4% of worldwide turnover, whichever is greater.

Section 90.12 caps the administrative monetary penalty for a business at $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater [1]. Section 91 sets penal fines of $15,000 to $25,000,000 or 4% of worldwide turnover, including for failing to report an incident or to take the required security measures [1]. These are ceilings; actual amounts depend on the circumstances.

**Example: what ceiling applies to a business with $3M in revenue?**

- Worldwide turnover for the preceding fiscal year (assumption) : $3,000,000
- 2% of turnover (administrative penalty) : $60,000
- Fixed amount in section 90.12 : $10,000,000
- Applicable ceiling (whichever is greater) : $10,000,000
- 4% of turnover (penal fine) : $120,000
- Applicable penal ceiling (whichever is greater, section 91) : $25,000,000
- **= For a small business, the fixed amounts set the ceilings, not the percentages**

## Where should you start to comply?

1. **Designate the privacy officer** — Confirm in writing who holds the role and publish their title and contact details on your website.
2. **Inventory your information** — List what you collect, where it is stored (software, cell phones, paper), who can access it and why.
3. **Write your policies** — Draft simple rules on retention, destruction and complaints; publish your privacy policy.
4. **Assess your vendors** — For each tool that handles personal information, do a proportionate PIA; add a written agreement if data leaves Quebec.
5. **Open the incident register** — Create the register today, even if it is empty, along with a one-page procedure for responding to an incident.
6. **Clean house** — Destroy information whose purposes have been achieved and that no law requires you to keep.

## How does Law 25 affect automation and AI?

Mainly through three sections: the PIA before adopting a tool, section 17 if data leaves Quebec, and section 12.1 if a decision is based exclusively on automated processing.

A decision made by software with no human involvement, such as turning down a booking, can fall under section 12.1 [1]. The guide [Human approval for AI agents](https://app.pilotiko.com/en/guides/human-approval-for-ai-agents) explains how to keep a person in the loop. For emails and texts, Canada's Anti-Spam Legislation applies on top of Law 25: see [Reduce no-shows](https://app.pilotiko.com/en/guides/reduce-no-shows).

For the big picture, read [Automating a service business](https://app.pilotiko.com/en/guides/automate-a-service-business). In Pilotiko, AI agents prepare the work and a person approves anything touching a customer, money or an outgoing message; your hosted website can carry your privacy page. To compare plans, see [pricing](https://app.pilotiko.com/en/pricing).

> Coming soon in Pilotiko: [email marketing](https://app.pilotiko.com/en/product/email-marketing). Consent and unsubscribe handling are already built; real sending is not.

## Frequently asked questions

### Does a one-person business need a privacy officer?

Yes, but it happens automatically: the person with the highest authority holds the role. You still need to publish their title and contact details on the business website, or make them available another way if there is no website.

### Do I need a privacy policy on my website?

If you collect personal information by technological means, such as a booking form, the law requires you to publish a privacy policy in simple, clear terms. Add the privacy officer's contact details there too.

### What is a PIA in practice?

It is a document describing the personal information a project handles, the risks to people and the measures that reduce them. It must be proportionate, so for a small online calendar a few pages are often enough. The privacy officer must be consulted from the start.

### Do I have to report a lost phone that holds customer files?

It always goes in the incident register. If it presents a risk of serious injury, for example because the files include door codes, you must notify the Commission and the people affected.

### Can I use American booking software?

Yes, provided you complete the assessment required by section 17 and sign a written agreement that reflects its results. Ask the vendor where the data is hosted and which protections apply.

### Does Law 25 cover my employees' information?

Yes. It protects all personal information the business holds, including its staff's. The same rules on security, access and destruction apply.

## Sources

1. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)
2. Commission d'accès à l'information du Québec, « Principaux changements apportés par la Loi 25 », https://www.cai.gouv.qc.ca/protection-renseignements-personnels/sujets-et-domaines-dinteret/principaux-changements-loi-25 (accessed on 2026-10-15)
3. Commission d'accès à l'information du Québec, « Responsabilité des entreprises : le responsable de la protection des renseignements personnels », https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/responsable-protection-renseignements-personnels-entreprise (accessed on 2026-10-15)
4. Commission d'accès à l'information du Québec, « Incidents de confidentialité et mesures de sécurité (entreprises) », https://www.cai.gouv.qc.ca/protection-renseignements-personnels/information-entreprises-privees/incidents-confidentialite-mesures-securite-entreprises (accessed on 2026-10-15)