Law 25: what SMBs must do, point by point

Law 25 (the Act to modernize legislative provisions as regards the protection of personal information, adopted in 2021) amended Québec's Act respecting the protection of personal information in the private sector. It applies to every business that collects, uses, keeps or communicates personal information in Québec, whether it has two employees or two hundred, and whether the information sits on its own servers or at a supplier. Here is what an SMB must have in place, point by point, with the source of each obligation.

Who the Act applies to

The Commission d'accès à l'information (CAI) is clear: the Act covers the personal information your business holds, in any form or medium, whether it is kept by the business or by a third party. The information does not need to be filed under a person's name. A customer list, an email list, résumés received, camera recordings: all of it is covered.

Three waves of obligations

The Act came into force in stages, and every stage still applies today.

Since September 2022

• A person in charge of the protection of personal information. By default, the person with the highest authority in the business. The role can be delegated in writing, in whole or in part. The title and contact details must be published on the business's website (or made available another way if there is no website).
• A register of confidentiality incidents. Every business must log all incidents involving personal information, including those that do not present a risk of serious injury. The register is kept for at least five years after the business became aware of the incident, and provided to the Commission on request.
• Notifications. When an incident presents a risk of serious injury, the business must notify the Commission and the persons concerned; the Regulation respecting confidentiality incidents sets what the notices contain. The business stays responsible even when the information was held by a supplier.

Since September 2023

• Governance policies and practices covering retention and destruction, staff roles and responsibilities throughout the information life cycle, and complaint handling; detailed information about them must be published on the website.
• A privacy policy in simple, clear terms, published on the site, for any business collecting personal information by technological means; changes must be announced.
• Consent requested for each purpose, in simple and clear terms, presented separately from any other information when requested in writing. Express consent is required before using sensitive information (medical, biometric, otherwise intimate) for a purpose other than the one it was collected for.
• Transparency at collection: the purposes and means of collection, the rights of access and rectification, the right to withdraw consent, the third parties the collection is made for, and the possibility that the information is communicated outside Québec.
• A privacy impact assessment (PIA) for any project to acquire, develop or overhaul an information system involving personal information, and before communicating information outside Québec, proportionate to the sensitivity of the information.
• Privacy settings at the highest level by default for any technological product or service offered to the public.
• Anonymization as an alternative to destruction, according to generally recognized best practices.
• Minors under 14: no collection from them without the consent of the holder of parental authority, unless clearly for the minor's benefit.
• Biometrics: any database of biometric characteristics must be disclosed to the Commission no later than 60 days before it goes into service, and biometric identification requires the person's express consent.

Since September 22, 2024

• The right to portability. On request, the business must communicate to the person, in a structured and commonly used technological format, the computerized personal information collected from them.

A checklist for an SMB

1. The privacy officer's name, title and contact details are published on the website.
2. An incident register exists, even if empty, with an entry template and a five-year retention rule.
3. A written procedure says who assesses the "risk of serious injury", who notifies the Commission and how the persons are reached.
4. The website's privacy policy is current, in plain language, and covers the tools actually used (analytics, forms, invoicing).
5. Governance policies (retention, destruction, roles, complaints) are written and summarized on the site.
6. Forms ask for consent per purpose, separately from everything else.
7. A PIA is done before any new system or any hosting outside Québec, including US cloud services.
8. The default settings of your online products are the most protective ones.
9. You know how to answer an access, rectification or portability request in a structured format.
10. Supplier contracts set out their duties in the event of an incident, since the responsibility remains yours.

Penalties

The Commission can impose administrative monetary penalties of up to 2% of worldwide turnover or $10 million, whichever is higher, notably for an unreported incident, neglected security measures or non-compliant collection. It can also bring penal proceedings within five years of an offence: for a business, the fine ranges from $15,000 to $25 million or 4% of worldwide turnover, and it is doubled for a repeat offence. A business can also give the Commission an undertaking to remedy a failure; if approved and honoured, it avoids the administrative penalty for the facts observed.

Where to start

Start with the inventory: which personal information you hold, where it is, who accesses it and how long you keep it. Without it, neither the policy, nor the PIA, nor the register holds up. That inventory is the starting point of a security audit and compliance assessment: a measured picture against the obligations above, then an action plan ordered by risk. Law 25 is first a matter of governance; technical security supports it, it does not replace it.