What Law 25 is
Law 25 is the Québec law that modernized the province's rules on the protection of personal information, including the Act that applies to private businesses. Its obligations came into force in stages and now apply to businesses that collect personal information about people in Québec.
A website is often the main place where a business collects personal information: contact forms, quote requests, newsletter sign-ups, customer accounts, online orders, analytics and advertising tools. That is why the website is usually the first place to look when you work on compliance.
This guide gives a general overview to help you plan your website. It is not legal advice. The Commission d'accès à l'information du Québec (CAI) is the authority responsible for these rules and publishes guidance for businesses; for your specific situation, consult the CAI's resources or a lawyer.
The main obligations that touch your website
- A designated person in charge: every business must have a person in charge of the protection of personal information. Their title and contact information should be easy to find, typically on the website.
- A privacy policy in clear terms: when you collect personal information through technology, such as a website, you must publish a policy explaining what you collect, why, how and for how long, written in simple, clear language. Changes to the policy must be communicated.
- Consent and transparency: people must know why their information is collected and how it will be used, and consent must be clear, for specific purposes.
- Identification, location and profiling technologies: before using a technology that can identify, locate or profile a person, you must inform them and explain how to activate those functions. The CAI's position is that such functions should not be active by default.
- Privacy by default: when you offer a technological product or service with privacy settings, those settings must provide the highest level of privacy by default.
- Privacy impact assessments: for projects to acquire, develop or redesign an information system or electronic service involving personal information, and before communicating personal information outside Québec.
- Confidentiality incidents: incidents that present a risk of serious injury must be reported to the CAI and to the people concerned, and every incident must be recorded in a register.
- Automated decisions: people must be informed when a decision about them is based exclusively on automated processing.
Website checklist
| Area | What to check |
|---|---|
| Forms | Ask only for what you need; say why each piece of information is collected |
| Newsletter | Separate, unticked consent; easy unsubscribe |
| Analytics and advertising | List every tool and pixel; inform visitors and offer a real choice for tracking |
| Cookie banner | Clear choices, in French, with no tracking before the visitor's choice where consent is required |
| Privacy policy page | Plain language, up to date, linked from every page and every form |
| Person in charge | Title and contact information published |
| Hosting and service providers | Know where data is stored and which providers process it; assess transfers outside Québec |
| Customer accounts | Strong authentication, private areas excluded from search engines, ability to correct or delete information |
| Retention | Delete what you no longer need; define how long you keep each type of information |
| Security | HTTPS everywhere, access limited to the people who need it, backups |
| Requests from individuals | A simple way to ask for access to, correction of or deletion of their information |
Step by step: bringing a website into line
- 01Map the data
List every place the website collects personal information, and every tool that receives it (form service, email platform, analytics, payment, hosting).
- 02Remove what is not needed
Each field you delete is information you no longer have to protect.
- 03Designate the person in charge
By default, this responsibility falls on the person with the highest authority in the business, who can delegate it in writing.
- 04Write or update the privacy policy
In clear terms, matching what the site really does, in French and in any other language of the site.
- 05Set up consent
A banner and settings that respect the visitor's choice, with tracking that does not start before it where consent is required.
- 06Document and review
Keep a record of your decisions, assessments and incidents, and review them when the site changes.
If a new tool or feature involves personal information, revisit these steps before launching it, not after.
Common mistakes on Québec websites
- A privacy policy copied from another site that describes tools you do not use and forgets the ones you do.
- Analytics or advertising pixels that start before the visitor's choice, even though the banner says otherwise.
- Forms that ask for everything: date of birth, full address or phone number when an email would do.
- No named person in charge, or a contact address that nobody reads.
- Old data kept forever: quote requests and inactive accounts from years ago, still stored in a mailbox or a database.
- A policy only in English on a site aimed at Québec, which also raises a language issue.
Hosting and data location
Many websites and SaaS platforms rely on cloud providers whose servers may be located outside Québec. That is common and not forbidden in itself, but communicating personal information outside Québec calls for an assessment before the transfer. Ask your web provider where your data is hosted and which subcontractors process it, and include that information in your assessment and your privacy policy.
For a SaaS, privacy questions are part of the design from day one: who can see what, what is logged, how an account is deleted. Our guide to SaaS development costs explains how this affects the scope.
How we approach privacy on the sites we build
On every website we build, the legal pages are planned from the start, forms collect only what the business needs, private areas are excluded from search engines, and access to data is restricted by security rules in the database. Our platforms, such as Fidelivet, separate data strictly by account. We use Firebase (Google Cloud) for hosting and data, and we tell clients where their data is stored so they can include it in their assessment.
The legal responsibility remains with your business, and we recommend having your policy reviewed by a professional. Language is the other rule to plan for in Québec: see our Bill 96 guide. For a new site or a review of an existing one, contact us (page in French; we reply in English).
Updated November 13, 2026