Is Your Website Law 25 Compliant? A Practical Checklist for Québec Businesses

General information, not legal advice. Last reviewed October 1, 2026 against the Commission d'accès à l'information du Québec (CAI) guidance. For decisions about your own obligations, consult a privacy lawyer.

If your business operates in Québec and collects personal information through its website (a contact form, a newsletter sign-up, analytics or an online store), Québec's Law 25 shapes how that website must handle the data. Here is what it means in practice for the site itself, and what we check when we build or audit one.

What Law 25 is

Law 25 modernized Québec's private-sector privacy law, the Act respecting the protection of personal information in the private sector. Its changes came into force in stages between September 2022 and September 2024. The law applies to people and organizations that carry on an enterprise in Québec, and the CAI notes that an organization based outside Québec that handles personal information as part of its activities in Québec is covered too.

It is enforced by the CAI. Businesses face administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4% of worldwide turnover, whichever is greater. Fines double for repeat offences.

The website checklist

1. Tracking technologies can't be on by default

If your site uses technology that can identify, locate or profile a visitor, such as many analytics and advertising tools, you must tell people beforehand, and those features cannot be activated by default. In practice that means a consent banner that lets visitors accept or refuse, with the tracking actually off until they accept, not just a banner that informs.

2. A privacy policy in clear, simple terms

Organizations that collect personal information by technological means must publish a privacy policy written in simple and clear terms, on their website or by another means that reaches the people concerned, and must notify people of changes to it. Explain what you collect, why, how long you keep it, who it is shared with (including providers outside Québec) and how people can exercise their rights.

3. Name and publish your privacy officer

By default, the person with the highest authority in the business is responsible for protecting personal information. That role can be delegated in writing, in whole or in part. The responsible person's title and contact information must be published on your website or made available by other appropriate means.

4. Forms: collect only what you need

Every form field should have a purpose you can explain. Remove "nice to have" fields, say why you ask for anything sensitive, and never pre-check consent boxes.

5. Assess before sending data outside Québec

Since September 2023, a privacy impact assessment is required before communicating personal information outside Québec, including when you entrust a provider outside Québec with collecting, using or keeping it. The information must be adequately protected, and the arrangement documented in a written agreement. Choosing Canadian cloud regions where possible simplifies this.

6. Be ready for portability requests

Since September 22, 2024, people can ask for the computerized personal information collected from them in a structured, commonly used technological format. Your site's data should be exportable without a developer digging through databases by hand.

7. Incidents: notify, and keep a register

A confidentiality incident that presents a risk of serious injury must be reported to the CAI and to the people affected. Every incident, serious or not, must be recorded in a register that you keep for at least five years and provide to the CAI on request. Logging and monitoring on your web systems make this possible.

How we handle it in the projects we build

When we build or rebuild a site, we set up consent-aware analytics, a privacy policy and privacy-officer page, forms reduced to what is needed, Canadian hosting regions where available, and exportable data. It is part of the build, not an add-on.

Want your current site reviewed? Contact our Montréal team. We work in English and French. You can also read about our web development services.

Sources: Commission d'accès à l'information du Québec, cai.gouv.qc.ca: main changes under Law 25; scope of the private-sector Act; penalties; the person in charge of personal information; confidentiality incidents.