Trois-Rivières, serving all of Quebec 450 231-3836 info@oktosolutions.ca
FR

Compliance and protection of personal information

Law 25 for Quebec SMBs: the guide to protecting personal information (formerly Bill 64)

Law 25 governs how a Quebec business collects, uses, keeps and destroys personal information. It sets no threshold: a ten-person SMB is covered exactly as a multinational is. This page brings together what the Act says, the deadlines already in force, the steps expected of an SMB, and the share of the work OKTO Solutions takes on.

Review your obligations See managed cybersecurity

Quebec’s Law 25 applies to every business in Quebec that holds personal information, with no employee or revenue threshold. Since September 22, 2024, it applies in full: a designated privacy officer whose contact details are published, governance policies posted online, a confidentiality incident register, an assessment before each new system, and a right to data portability.

The basics

What is Law 25 and who does it apply to?

Law 25 is a nickname. The real text is the Act to modernize legislative provisions as regards the protection of personal information. Tabled as Bill 64, it was assented to on September 22, 2021 under the reference 2021, chapter 25, and that chapter number is where the everyday name comes from. The Act does not stand on its own: it amends other Quebec statutes. For a private company, the one that matters is the Act respecting the protection of personal information in the private sector, chapter P-39.1. Those are the sections cited throughout this page, because those are the ones an owner or a manager actually has to know.

  • Who is coveredAnyone who operates an enterprise in Quebec, including a self-employed worker. An association or a partnership that operates an enterprise carries the same obligations (s. 96).
  • What is protectedAny information that relates to a natural person and allows that person to be identified, directly or indirectly (s. 2). A name, an email address, an employee file, a client account number.
Six pieces of personal information in one ordinary client record. One client or a thousand, the same obligations.
  • Who is not coveredPublic bodies, which answer to the Access to Information Act, and health and social services information held by a body governed by chapter R-22.1 (s. 3).
  • Who enforces itThe Commission d’accès à l’information du Québec. It investigates, inspects, issues orders and imposes administrative monetary penalties.

The timeline

Which obligations are already in force?

The three deadlines set by section 175 of Law 25 have all come and gone. The Act has applied in full since September 22, 2024. An SMB that has put nothing in place is not early on a schedule; it is in default.

September 22, 2022

Privacy officer and incidents

A person in charge of the protection of personal information holds the role. By default that is the person with the highest authority in the enterprise, who may delegate in writing. Their title and contact information are published on the company website (s. 3.1).

Notify the Commission d’accès à l’information promptly when an incident presents a risk of serious injury, and notify every person concerned (s. 3.5).

Keep a register of confidentiality incidents, a copy of which is sent to the Commission on request (s. 3.8).

September 22, 2023

Governance, consent and transparency

Establish policies and practices governing the handling of personal information, and publish the details on the company website in clear and simple language (s. 3.2).

Carry out a privacy impact assessment before any project to acquire, develop or overhaul an information system (s. 3.3).

Inform the person at the time of collection and obtain express, free and informed consent, requested separately for each purpose (ss. 8 and 14). Set the privacy parameters of a product offered to the public to the highest level by default (s. 9.1).

September 22, 2024

Data portability

On request, release to the person concerned the computerized personal information collected from that person, in a structured and commonly used technological format (s. 27, third paragraph).

Send it to the person or body they designate. The obligation does not cover information created or inferred by the enterprise.

Since that date there is no further wave coming. The regime is complete.

Obligation by obligation

What each obligation means in practice

The right-hand column settles most of the arguments. Part of the work belongs to your management and your legal counsel. The rest is technical, and that part is ours.

ObligationWhat it means in practiceWho handles it
Privacy officer designated and published (s. 3.1)The person with the highest authority holds the role by default. Their title and contact information go on your website.Your management decides. OKTO supplies the page and the technical point of contact.
Governance policies published (s. 3.2)Retention, destruction, staff roles and complaint handling, explained in plain language on your website.Your management, with your legal counsel. OKTO then applies the retention periods inside the tools.
Confidentiality incident register (s. 3.8)A register of every incident, including the ones you do not report. A copy goes to the Commission on request.Your privacy officer keeps the register. OKTO supplies the technical record behind each incident.
Notice to the Commission and to individuals (s. 3.5)Notify promptly when an incident presents a risk of serious injury.The call belongs to your business. OKTO establishes the scope, the dates and what was touched.
Privacy impact assessment (ss. 3.3 and 17)Before any project to acquire, develop or overhaul a system, and before moving personal information outside Quebec.Joint work. OKTO documents the technical side and the protection measures already in place.
Written contract with your vendors (s. 18.3)The mandate has to state the measures the vendor takes to protect confidentiality. Cloud, payroll, newsletter.Your management signs. OKTO draws up the list of vendors that actually touch your data.
Reasonable security measures (s. 10)Multifactor authentication, encryption, access control, logging, tested backups.OKTO, almost entirely.
Destruction or anonymization (s. 23)Once the purpose of collection is fulfilled, the information goes, unless a statute sets a retention period.You set the periods. OKTO enforces them in the systems instead of leaving them on paper.
Data portability (s. 27)On request, hand over the computerized information in a structured and commonly used format.OKTO runs the extraction. Your privacy officer answers the person.
Automated decision-making (s. 12.1)Inform the person no later than when the decision is made, and let them submit observations.Your management. OKTO finds where automated processing decides something in your systems.

The key role

What does the privacy officer actually do?

This is the person who answers when somebody asks where their data is, who decides whether an incident gets reported, and who keeps the register. By default it is the executive with the highest authority. Plenty of SMBs find out partway through that they already have a privacy officer, and that it is the president. The role can be delegated in writing, in whole or in part, to somebody else: an HR director, a controller, sometimes an outside advisor. What cannot be delegated is the existence of the role itself. And the obligation that follows gets missed almost every time: that person’s title and contact information have to be published on your website, or made available another way if you do not have one.

One page, ten minutes. Publishing the name, title and email address of the privacy officer next to your privacy policy is the fastest move in the whole exercise. It is also the first thing somebody checks when they want to know whether you have started.
The role already exists in your business. What is almost always missing is the name published on your website.

The register

What goes into the confidentiality incident register?

Every incident, not only the ones you report. Section 3.6 defines an incident in four cases: unauthorized access to personal information, unauthorized use of it, unauthorized release of it, or its loss and any other breach of its protection. Most incidents at an SMB are nothing dramatic.

The email that went to the wrong person

The payroll list sent to the wrong Martin. That is an incident, and it belongs in the register.

The lost USB key

An unencrypted drive holding employee files changes the entire risk assessment.

A former employee’s account

Still active six months after the departure, still reaching the shared folders. Nobody had looked.

The wide open network share

An HR folder readable by the whole organization for years. Unauthorized access counts.

An employee finding a compromised mailbox alert at her desk

What the register asks for, and why that is technical

A useful register records the date of the incident, the date you found out, the nature of the information involved, how many people were affected, the cause, the steps taken to reduce the risk, and the decision to report or not. Every one of those lines assumes somebody can reconstruct what happened inside your systems. Without central logging, an SMB fills the register with guesses, and a report filed with the Commission that rests on guesses is a problem all by itself.

That is exactly the part OKTO takes on. Monitoring the workstations and the accounts produces the record, and the record produces the register. The rest of the technical work is laid out on our page on managed cybersecurity for small business.

Before every new system

The privacy impact assessment, in plain terms

The name sounds heavy, the thing itself is simple. Before you buy, build or rebuild an information system that touches personal information, you have to assess what the project changes for people’s privacy (s. 3.3). The Act does not prescribe a form, but a written assessment is the only kind you can prove. A second situation triggers it: moving personal information outside Quebec. The Act does not forbid that, it requires an assessment covering the sensitivity of the information, the purpose it is used for, the protection measures it would be given, contractual ones included, and the legal framework of the destination country (s. 17). The release can go ahead if the assessment shows the protection is adequate.

In practice that means documenting your choice of cloud provider and keeping the assessment, not giving up on the cloud. OKTO produces the technical half of the file: where the data lives, who reaches it, how it travels, what the vendor commits to. See also our cloud and Azure services.

The plan

Six steps to get compliant

None of this calls for an in-house legal department. What stalls an SMB, in practice, is the data inventory and the technical work. The first pass takes the longest; after that it is maintenance.

  1. Designate and publish the privacy officerName the person, write down the delegation if you make one, then publish their title and contact information on your site. Budget an hour.
  2. Inventory the personal informationWhat data you hold, where it actually sits, who reaches it and how long you keep it. Workstations, servers, mailboxes, SharePoint, OneDrive, backups, third-party applications. This is the longest step and the one that turns up the most surprises.
  3. Write and publish your governance policiesRetention, destruction, staff roles across the life cycle of the information, complaint handling. Then publish the details in clear and simple language, next to your privacy policy.
  4. Put your vendors under contract and revisit your consentsA written contract with every vendor that touches your data, spelling out the protection measures required. In parallel, go through forms and newsletters so consent is requested separately, for each purpose, in plain language.
  5. Open the register and write the incident procedureWho decides, who notifies the Commission, who notifies the people affected, on what criteria and within what timeframe. The register opens the day the procedure is written, not the day of the first incident.
  6. Lock down the technical side, then review every yearMultifactor authentication, access reviews, removal of dormant accounts, laptop encryption, logging, tested backups. After that, an annual review and an assessment before each new system are enough to keep it current.

What the Act provides for

What penalties apply if nothing gets done?

The Act lays out three separate routes: an administrative monetary penalty imposed by the Commission, a penal fine handed down by a court, and punitive damages claimed by the person harmed. The amounts below come straight from the statute.

Route provided by the ActNatural personOther casesSection
Administrative monetary penaltyMaximum of $50,000Maximum of $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is highers. 90.12
Penal fineFrom $5,000 to $100,000From $15,000 to $25,000,000 or 4% of worldwide turnover for the preceding fiscal year, whichever is highers. 91
Punitive damagesAt least $1,000 where the unlawful infringement is intentional or results from a gross fault and causes injurys. 93.1

These are ceilings, not tickets

The Commission publishes a framework setting out how it calculates: the seriousness and duration of the failure, the sensitivity of the information, how many people were affected, the corrective steps taken, the degree of cooperation, and the ability to pay (s. 90.2). A notice of non-compliance has to come before the penalty.

A second offence costs double

Among the acts covered are collecting, using, releasing, keeping or destroying information contrary to the Act, failing to report an incident, and failing to take the security measures required by section 10. For a subsequent offence, the fines are doubled (s. 92.1).

Directors are named too

The claim for punitive damages belongs to the person concerned, not to the Commission. And a director or officer who directed, authorized or simply consented to the offending act is a party to the offence and liable to the same penalty (s. 93).

For an SMB, the real question is not the theoretical size of the fine. It is whether you can show, with documents, what was put in place and on what date. A register that is kept, policies that are published and access rights that get reviewed are worth more than good intentions.

Our share of the work

What OKTO does, and what OKTO does not do

OKTO takes the technical and organizational half: finding the data, locking down access, detecting incidents and documenting what was done. The legal calls are not ours to make.

Read this before going further. This page is informational and does not replace legal advice. OKTO Solutions is not a law firm. We do not declare a business compliant within the meaning of the Act, and we do not decide whether a given incident has to be reported to the Commission: that decision belongs to your business, with its legal counsel. For an opinion, speak to a Quebec lawyer or notary.
  • Technical inventoryWhere the personal information really lives: workstations, servers, mailboxes, SharePoint, OneDrive, backups, third-party applications.
  • Access controlMultifactor authentication, rights reviews, removal of former employee accounts, logging of what gets opened.
  • EncryptionLaptops, removable media and backups, so that losing a device does not turn into losing personal information.
Compliance work items listed on a whiteboard during a planning session
  • Detection and evidenceMonitoring of workstations and accounts, and a technical record of what happened when an incident hits.
  • Retention and destructionEnforcing in the tools the retention periods your policies announce.
  • Dated documentationProof of the measures in place and of when they went in, because that is what you will be asked to demonstrate.
  • vCIO supportCarrying the subject into the annual IT plan, settling priorities and tracking the budget with management.

Deciding and writing it down happens with your privacy officer and, when needed, your lawyer. Making it hold up inside your systems is our job.

Antonio Pazzi, founder of OKTO Solutions
Check it for yourself. The primary sources are public and free: the Act respecting the protection of personal information in the private sector, chapter P-39.1, published on LégisQuébec, the assented text of Law 25 at Publications du Québec, and the site of the Commission d’accès à l’information du Québec, which hosts the confidentiality incident reporting form.

The first concrete move is almost always a technical audit: it establishes where the personal information sits and who can reach it. It pairs well with our managed IT services, with hardening Microsoft 365 and with backup and disaster recovery, since retention and destruction reach your copies too. We work with SMBs across the Mauricie, the South Shore of Montreal and the Quebec City area.

Questions and answers

Common questions about Law 25

Does Law 25 apply to a small business with 10 employees?
Yes. The Act covers anyone who operates an enterprise in Quebec and holds personal information about other people. There is no employee threshold, no revenue threshold and no small business exemption. What size does change is the expected scale: section 3.2 requires your policies to be proportionate to the nature and scope of your activities.
What is the difference between Law 25 and Bill 64?
There is none, it is the same text. The bill was tabled in the National Assembly as number 64, then assented to on September 22, 2021 under the reference 2021, chapter 25. The name Law 25 comes from that chapter number. If a vendor still talks to you about Bill 64 compliance, they mean exactly the same thing.
Do we have to appoint a person in charge of personal information protection?
You already have one, even if you have done nothing about it. Section 3.1 provides that the person with the highest authority in the enterprise holds the role by default. That person may delegate it in writing, in whole or in part. The obligation that gets forgotten next is publishing that person’s title and contact information on the company website.
What counts as a confidentiality incident?
Section 3.6 sets out four cases: unauthorized access to personal information, unauthorized use of it, unauthorized release of it, or its loss and any other breach of its protection. That covers ransomware, but also the email sent to the wrong recipient, the lost USB key, the network share left wide open and the former employee whose account was never closed.
When do we have to report an incident to the Commission d’accès à l’information?
When the incident presents a risk of serious injury, you must notify the Commission promptly and notify each person concerned as well (s. 3.5). To weigh that risk, the Act asks you to consider the sensitivity of the information, the apprehended consequences and the likelihood of it being used for a harmful purpose, in consultation with your privacy officer (s. 3.7). An incident below that threshold is not reported, but it still has to be entered in the register.
Can we host our data outside Quebec?
The Act does not forbid it. It adds a step first: a privacy impact assessment that takes into account the sensitivity of the information, the purpose for which it is used, the protection measures it would be given, including contractual measures, and the legal framework of the destination country (s. 17). In practice that means documenting your choice of cloud provider and keeping the assessment on file.
What fines does Law 25 provide for?
Three regimes run side by side. The administrative monetary penalty imposed by the Commission is capped at $50,000 for a natural person and, in other cases, at $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is higher (s. 90.12). The penal fine runs from $5,000 to $100,000 for a natural person and, in other cases, from $15,000 to $25,000,000 or 4% of worldwide turnover (s. 91). The person harmed may also claim punitive damages of at least $1,000 (s. 93.1).
Is a privacy policy on our website enough?
No. Section 3.2 requires you to establish policies and practices governing the handling of personal information, covering retention and destruction, the roles of staff throughout the information life cycle, and a complaint handling process. Detailed information about them has to be published in clear and simple language, together with the title and contact information of the privacy officer. A generic policy does not cover that.

Take stock of your Law 25 obligations

If you do not know where your personal information sits, who can reach it or what goes out to a vendor, start there. OKTO runs the technical inventory, fixes the access rights, puts detection in place, then hands you a file that documents what was done and when.

Ask for a Law 25 review See managed cybersecurity