Quebec Law 25: What Small Businesses Need to Know

• Law 25 is Quebec’s privacy law, setting rules for how any business collects, uses, and shares Quebec residents’ personal information.
• It applies no matter your size, so small businesses and nonprofits that market to Quebec contacts are covered, not just big companies.
• The core duties are practical: Name a privacy lead, get clear consent, publish a privacy policy, and report serious breaches.
• The penalties are real, so building consent and privacy habits into your everyday email marketing is the safest path.

Quebec Law 25 is the provincial privacy law that governs how organizations collect, use, store, and share the personal information of people in Quebec.

If you run a small business or nonprofit that emails customers in Quebec, this law likely applies to you. It doesn’t matter whether you’re based in Montreal, Halifax, or Vancouver.

Of course, you can keep building your list while you follow the rules. In this blog we’ll cover what counts as personal information, the steps to comply, and how to check your readiness. We’ll also walk through the key requirements and penalties, best practices, common mistakes, and quick answers to the questions you’re likely asking.

What is Quebec Law 25?

Quebec modernized its privacy rules in 2021, and Law 25 is the common name for that update. It reshaped the province’s Private Sector Act (P-39.1) and raised the bar for consent, transparency, and data protection.

Under the Act itself, consent must be manifest, free, informed, and given for specific purposes, and it applies to personal information collected by anyone carrying on an enterprise.

Law 25 didn’t land all at once. It came into force starting in 2022 and was phased in over three years through 2024.

Here’s what Law 25 covers at a high level:

• Scope: It applies to any enterprise handling the personal information of Quebec residents, regardless of business size.
• Consent standard: Quebec sets a high bar for how you ask permission before you collect data.
• A privacy lead: You must designate a person in charge of protecting personal information and publish their title and contact details.
• Breach reporting: Serious confidentiality incidents must be reported to the regulator and to the people affected.
• Data portability: Since 2024-09-22, people can ask for their computerized data in a structured, commonly used format.

Law 25 is enforced by the Commission d’accès à l’information du Québec (CAI), the province’s privacy regulator. It isn’t the same as Canada’s Anti-Spam Legislation (CASL), the anti-spam law enforced by the Canadian Radio-television and Telecommunications Commission (CRTC).

CASL governs the commercial messages you send, such as email and texts. Every message needs consent, clear sender identification with your business name and mailing address, and an unsubscribe that works within 10 business days. For a refresher on what CASL covers, remember it recognizes two kinds of permission.

Under CASL, express consent is actively given and documented, and it doesn’t expire. Implied consent is temporary: It lasts two years from a purchase or six months from an inquiry, after which you need fresh express consent.

Law 25 is a privacy law, so it works alongside CASL rather than replacing it. Outside Quebec, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply. It’s enforced by the Office of the Privacy Commissioner of Canada (OPC), though Law 25 sets a stricter bar for Quebec residents.

Law 25 also differs from the European Union’s General Data Protection Regulation (GDPR), so see how GDPR compares if you sell abroad.

This matters for everyday marketing. According to Constant Contact’s Q1 2026 Small Business Now report, 41% of small business owners expect email marketing to be their most valuable channel this year. Protecting your right to reach Quebec contacts keeps that channel open and your customers’ trust intact.

Types of personal information Law 25 protects

What kind of information does Law 25 actually protect? Almost anything that can identify a person counts, and some categories carry extra rules. Start by sorting what you collect into basic, sensitive, and behavioural categories.

Basic contact and identity information

This is the everyday data you collect to reach and recognize a customer. It’s the information most small businesses store first, often the moment someone joins a list.

A Montreal bakery, for example, gathers this data through its newsletter signup and its online order form. You still need clear consent to collect it and a stated reason for keeping it.

Here are some example items:

• A customer’s full name and email address.
• A billing address and postal code.

Sensitive personal information

Sensitive information could cause real harm if it’s exposed, so Law 25 requires express consent to collect it. You have to ask directly and record a clear yes.

A Halifax fitness studio runs into this when it stores health notes or payment details. Treat this data with extra care, and only keep it when you truly need it.

Here are some example items:

• Health details such as an injury note or medical clearance.
• Financial data such as a bank account or card number.

Behavioural and technical information

If you track how people open your emails or browse your website, that activity counts as personal information too. It can quietly build a detailed profile, so it deserves the same respect as a name or address.

A Quebec food bank might track email opens to see which appeals resonate. Be transparent about this tracking, because people don’t expect to be followed without knowing.

Here are some example items:

• Website cookies and browsing history.
• Email open and click activity.

How to comply with Law 25

Getting compliant is a set of clear steps, not a mystery. Work through them in order, and you’ll cover the duties that matter most for a marketing team.

Step 1: Appoint a person in charge of privacy

Name one person to own privacy questions, requests, and incidents. Publish that person’s title and contact details so people know who to reach.

In a small shop, this is often the owner or an office manager. The point is accountability: Someone answers when a customer asks how you handle their data. Write the role into a job description so it doesn’t get lost.

Step 2: Get clear, specific consent

Now for the good stuff: turning casual signups into clear, recorded consent. Ask people to opt in, tell them what they’ll get, and save proof of their choice.

Use sign-up forms that state exactly what someone is agreeing to before they join. Constant Contact can also help you manage subscriber consent by storing the date and method for each contact. A Montreal café that logs how each subscriber opted in has an answer ready if anyone asks.

Step 3: Publish a clear privacy policy

Tell people what you collect, why you collect it, and how they can reach your privacy lead. Keep the language plain so a busy reader understands it fast.

Write a clear privacy policy that explains your data practices in everyday words. Link it from your signup forms and your website footer. Review it whenever you change tools or start collecting something new.

Step 4: Build a breach response plan

Decide in advance who acts if data is exposed and how you’ll respond. A plan on paper beats a scramble during a real incident.

Your plan should name the person who leads the response and the steps to notify the CAI and affected people. A Halifax studio that drafts this once can act quickly if a laptop goes missing. Keep a register of incidents so you can track what happened and what you fixed.

Is your business ready for Law 25?

A short self-check for readiness helps you find the gaps before a customer or the regulator does.

Map the personal information you collect

List every place you gather data and every reason you keep it. You can’t protect information you didn’t know you had.

Walk through your signup forms, order pages, and any spreadsheets. Note what you collect, where it lives, and who can see it. This map becomes the backbone of your privacy policy and your consent records.

A bakery, for instance, might find customer data in its point-of-sale system, a newsletter form, and a staff spreadsheet.

Review your consent and records

Check that each contact opted in and that you can prove it. Consent without a record is hard to defend.

Confirm that your records show the date, method, and wording for each subscriber. Clean up contacts you can’t account for. Using an email platform like Constant Contact can do a lot of the heavy lifting for you here, with consent tracking and clear unsubscribe built in.

Test your breach response

Run a quick drill against your plan and see where it stalls. A short test now saves hours during a real event.

Pick a scenario, such as a stolen phone or a misdirected export, and walk your team through it. Note who was unclear on their role and fix the gaps. Update your register template so it’s ready to fill in.

Key Law 25 requirements for Quebec businesses

Know these core requirements before you send your next campaign. They’re the obligations most likely to trip up a small marketing team.

Consent, privacy leads, and data portability

Law 25 requires consent that is manifest, free, informed, and specific, plus express consent for sensitive data. You also have to name a person in charge of protecting personal information and publish their contact details.

Data portability is now part of the picture too. Since 2024-09-22, a person can ask you to hand over their computerized personal information in a structured, commonly used technological format. An online retailer, for example, might get a request for a copy of a customer’s stored signup and order data. Build a simple process so you can answer these requests without panic.

Breach (confidentiality incident) reporting

You must report a confidentiality incident that poses a serious risk of harm to both the CAI and the people affected. You also have to keep a register of incidents. A stolen laptop full of subscriber records is the kind of incident that could trigger both steps.

See the regulator’s guidance for how to judge a serious risk of harm. Record what happened, what data was involved, and how you responded. A tidy register makes each future incident easier to handle.

Penalties and enforcement

Law 25 carries two separate penalty tracks, and both can be steep. Keep them distinct so you understand your exposure.

According to the Commission d’accès à l’information, administrative monetary penalties can reach 2% of worldwide turnover or C$10 million. Penal fines for an enterprise are separate, ranging from C$15,000 up to C$25 million or 4% of worldwide turnover, whichever is greater. A business that ignored consent rules and never reported a serious breach is the kind of case that draws these penalties. The size of these figures is one more reason to build good habits early.

Law 25 best practices

Want habits that keep you compliant without extra work? Build these practices into your routine so privacy becomes part of how you market, not a yearly fire drill.

• Collect only what you need: Ask for the minimum data that serves a clear purpose.
• Get consent up front: Tell people what they’re signing up for before they opt in.
• Keep consent records: Save the date, method, and wording for each contact.
• Review your list regularly: Remove contacts whose consent has expired or who opted out.
• Name a privacy lead: Make sure one person owns privacy questions and data requests.
• Have a breach plan ready: Write down who acts and how you’ll notify people.
• Stay aware of other laws: If you handle data outside Quebec, review other privacy laws that may apply.

Small habits like these keep your marketing clean and your contacts confident.

Common Law 25 mistakes

Most compliance slip-ups come from old habits, not bad intent. Here are the ones that catch small businesses most often, with a fix for each.

• The mistake: treating CASL consent as the same thing as Law 25 consent.
• How to fix it: Track them separately, since CASL covers your messages and Law 25 covers how you handle the data behind them.

• The mistake: assuming a business is too small to be covered.
• How to fix it: Apply the rules regardless of size, because Law 25 has no small-business exemption.

• The mistake: publishing a privacy policy once and never touching it again.
• How to fix it: Review it whenever you change tools or start collecting new data.

• The mistake: ignoring requests for someone’s data or a copy in portable format.
• How to fix it: Build a simple intake process so requests get answered on time.

• The mistake: keeping contacts you can’t account for.
• How to fix it: It stings to prune your list, but fresh consent protects you, so remove contacts you can’t verify.

Market with confidence in Quebec

You now have the essentials: Clear consent, a named privacy lead, a current privacy policy, and a breach plan. If you’re a Constant Contact customer with specific questions about Law 25, reach out to our Support team.

Otherwise, if you’re ready to take compliance seriously, start a free 30-day trial to see how Constant Contact’s consent tracking, permission management, and reporting tools help you stay compliant while building stronger relationships with your contacts.

NOTE: The information on this page is meant to help you understand Law 25 and isn’t a substitute for legal advice. For the official regulation text, visit the official Law 25 text.

FAQs

Does Law 25 apply to small businesses?

Yes, Law 25 applies to any enterprise that handles the personal information of Quebec residents, regardless of size. A small bakery or a two-person studio is covered the same way a large company is. Even a shop outside Quebec that emails Quebec subscribers needs to comply.

What’s the difference between Law 25 and CASL?

Law 25 is a privacy law about how you handle personal information, while CASL is an anti-spam law about the commercial messages you send. You need to follow both if you market to people in Quebec.

Do nonprofits have to follow Law 25?

It can apply to a nonprofit when its activities amount to carrying on an enterprise. Because the answer depends on the details, a specific case may warrant a legal review.

What are the penalties for breaking Law 25?

Penalties come in two separate tracks: administrative monetary penalties and penal fines. Both can be significant, which is why building consent and privacy habits early is the safer path.

When did Law 25 take effect?

Law 25’s obligations phased in on 2022-09-22, 2023-09-22, and 2024-09-22. Data portability has applied since the 2024 date.