How to · Guide gratuit
Quebec's privacy law and your website: are you covered?
Law 25 is Quebec's law on the protection of personal information, and it applies to small businesses too. If your site has a contact form, you have obligations. Here they are, in plain words.
- Got a form? You have obligations. A name and an email are already personal information.
- A privacy policy in French, linked in every footer.
- A cookie notice if your site sets any, honest about what it actually does.
- A designated officer. In a small business that's usually the owner, and that's fine.
- Say where the data goes, especially if a tool sends it outside Quebec.
- If there's a breach: log it, then notify the privacy commission if the risk of harm is serious.
01What it is, and why it concerns you
Law 25 modernized the protection of personal information in Quebec. Its main obligations have been in force since September 2023, and contrary to what a lot of people think, it isn't aimed only at big companies: any business that collects personal information is covered. A small business with a contact form counts.
02Your form is a collection
A name, an email, a phone number: the moment someone fills in your form, you're collecting personal information. What that means in practice:
- Collect only what you need. If you call people back, ask for the number. Not their date of birth.
- Say why you're collecting: to answer the request. That's it, and it fits in one line.
- Don't keep it forever. As long as it takes to serve the person, plus a reasonable stretch after.
03The privacy policy
That's the page explaining, in French and in plain words: who you are, what you collect, why, where it goes, how long you keep it, and what people's rights are (see it, correct it, have it deleted). It gets linked in every footer, and under your form.
An honest policy of ten short paragraphs beats a lawyer's novel copied from an American site. If it describes things your site doesn't do, it's worse than useless.
04Cookies
If your site sets cookies that aren't necessary for it to work (analytics tools, advertising pixels, embedded videos), you need the person's consent BEFORE turning them on. That's the famous banner.
And here, honesty pays: if your site sets ONE cookie to remember a choice, say exactly that, with a single « Got it » button. Offering « Reject all » when there's nothing to reject, or hiding twenty trackers behind « Accept all », are both wrong answers.
05The officer, and what to do if it leaks
- The privacy officer: the law asks you to designate one. By default it's the highest-ranking person in the business. In a small business, that's you, and your name with a contact email in the policy does the job.
- If an incident happens (leak, unauthorized access, stolen laptop): you must log it in a register, and if the incident presents a risk of serious harm, notify the Commission d'accès à l'information AND the people affected.
06The full checklist
- Form: only the fields you actually need
- A line under the form pointing to the policy
- Privacy policy in French, linked in the footer
- Cookie notice if the site sets any, honest about what it does
- Designated officer, named in the policy with a contact
- Incident register ready (a simple dated document is enough to start)
- The site's third-party tools known, and transfers outside Quebec mentioned
Published February 10, 2026