⚖️ Compliance — Quebec Law 25

Are you compliant with Quebec’s Law 25?

8 questions, 2 minutes. Get a clear score and the exact list of what is left to do — plain language.

⚖️ This tool is educational: it gives you a clear starting point but is not legal advice. For your specific situation, consult a professional.
0/8 answered

1Have you appointed a privacy officer and published their contact details?

By default it is the highest-authority person in the company. Appoint them officially and show their name and email (often in the privacy policy).

2Does your website publish a clear, accessible privacy policy?

Publish a policy explaining what information you collect, why, who you share it with, and people’s rights.

3Do you ask for clear consent before collecting personal information (forms, newsletter)?

Add an explicit, non-pre-checked consent box to your forms, explaining how the information will be used.

4If your site uses tracking cookies (analytics, ads), do you show a consent banner?

A cookie consent banner is required as soon as you track visitors (Google Analytics, ad pixels, etc.).

5Do you have a plan to respond to a data breach (notify the access-to-information commission and affected people)?

Document who does what during an incident, and how to notify the authority and affected people if the risk of serious harm exists.

6Do you keep a register of confidentiality incidents?

The law requires logging every incident. A simple table (date, nature, people affected, actions taken) is enough to start.

7Are your vendors that process information for you (newsletter, CRM, hosting) bound by contract?

Make sure your contracts require vendors to protect the information you entrust to them.

8Do you take reasonable security measures (strong passwords, email security, HTTPS site)?

Security is part of the law. Check your email and website security for free with Cyberbilan — run the scan.

What Law 25 asks, in plain terms

Law 25 (formerly Bill 64) is Quebec’s personal-information protection law. It applies to almost every private business, regardless of size. The basic obligations: a public privacy policy, a privacy officer, clear consent, incident handling (with a register), vendor contracts, and reasonable security measures. This check covers those fundamentals.

Frequently asked questions

What is Law 25?

Law 25 (formerly Bill 64) modernizes personal-information protection in Quebec. It imposes obligations on almost every private business: privacy policy, consent, privacy officer, incident handling, and more.

Does it apply to my small business?

Yes. Law 25 applies to any private business that collects personal information, regardless of size — even a sole proprietor with a newsletter.

What are the penalties?

Penalties can be significant: up to $25 million or 4% of worldwide turnover for the most serious violations. All the more reason to cover the basics.

Does this check make me compliant?

No. It is an educational self-assessment that shows where you stand and where to start. It is not legal advice.

Go further