Cybersecurity for small businesses in Québec: the simple guide
Run a small business in Québec with no IT team? Here are the real risks, what Law 25 requires of you, and the simple steps to protect yourself.
In short: a small business holds real customer data and real money, often with fewer protections than a large company — which is exactly what makes it a target. Québec's Law 25 now requires you to protect that data and report any breach. A few simple measures cover most of the risk.
Why Québec small businesses are targeted
Fraudsters don't only go after big companies. According to Statistics Canada, about 16% of businesses reported a cybersecurity incident. A small business is often an easier target: just as much valuable data, but fewer resources to defend it.
The 4 most common threats
Phishing — a fake email that pushes an employee to click or hand over a password. The number-one way in.
Domain spoofing — a fraudster sends email in your company's name (see our spoofing guide).
CEO fraud / fake invoice — impersonating your boss or a supplier to obtain a wire transfer (see CEO fraud).
Insecure website — no HTTPS, expired certificate, missing headers (see Not secure).
What Law 25 requires of your business
Since 2023, Law 25 requires every Québec business to protect the personal information it holds, appoint a person in charge, and report to the Commission d'accès à l'information (CAI) any privacy incident that presents a serious risk. Showing that you had taken reasonable measures (such as DMARC at reject) completely changes how an incident is assessed. Details in our Law 25 and email guide.
Close the spoofing door: SPF, DKIM and DMARC at reject.
Turn on two-factor authentication on your email and key accounts.
Train your team to spot phishing (one hour a year sharply reduces the risk).
Secure your website (HTTPS, up-to-date certificate) and back up regularly.
Where to start today
The highest-payoff move takes 15 seconds: enter your domain in the free check below. You'll immediately know whether your email can be spoofed and what to fix first — in plain language.
Check your setup for free
Enter your domain: we test your SPF, DKIM, DMARC and website, and give you the exact action plan.