Law 25 modernized the rules for protecting personal information in Quebec. Its obligations came into force gradually between 2022 and 2024, and they apply to SMBs too.
A designated person in charge
By default, it's the person with the highest authority in the business. This role can be delegated in writing. The person's title and contact information must be published on your website.
Handling incidents
In the event of a confidentiality incident (loss, unauthorized access, data theft), you must assess the risk, keep an incident register, and notify the Commission d'accès à l'information and the people affected if there is a risk of serious injury.
Clear policies
You must adopt governance rules for personal information and publish a privacy policy in plain terms, particularly if you collect information through technological means such as a website.
Consent
Consent must be manifest, free, informed and given for specific purposes. Your tools' privacy settings must offer the highest level of protection by default.
Retention and destruction
Don't keep information longer than necessary, and destroy it securely.
Where to start
- Designate the person in charge and publish their contact information.
- Take stock of the information you collect.
- Update your privacy policy.
- Create your incident register.
See the Commission d'accès à l'information du Québec website for details. This article is for information only and does not constitute legal advice.
