Law 25 and privacy: what a Québec small business should know

For a few years now, people in Québec have been talking about Law 25 on the protection of personal information, and it worries a lot of small-business owners. Good news: if you run a simple site, you don’t need a lawyer or to drown in jargon. By understanding two or three basic principles, you can get compliant and, above all, treat your clients better. One important note: this is general information, not legal advice.

What information you actually collect

The first question to ask yourself is simple: what personal information does my site gather? Often it’s less than you think. A contact form, a newsletter, a booking. Every field you request is a piece of information you become responsible for, so only ask for what you truly need.

• Name and email in a contact form.
• Address or phone for a booking or delivery.
• Newsletter addresses people have entrusted to you.
• Visit statistics, depending on the tool you use.

Consent means asking clearly

Law 25 cares a lot about consent: people must know what you collect and why, and agree to it. In practice, that means being transparent. Explain in one sentence next to your form what the information will be used for, and don’t use it for anything else later. If someone signs up for your newsletter, that’s not permission to resell their email.

The golden rule is simple: collect only what’s necessary, use it only for what you announced, and keep it safe. Everything else follows from that.

A privacy policy, made simple

The law requires you to have a privacy policy accessible on your site. It sounds intimidating, but it’s mostly an honest page answering a few questions: what information you collect, why, who you share it with (if anyone), and how someone can ask you to correct or delete it. Written in plain words, it reassures your clients instead of boring them.

Privacy isn’t just a legal obligation. It’s a sign of respect, and respect builds loyalty.

Naming someone responsible and staying careful

The law says someone must be responsible for protecting personal information in the business. In a small business, that’s often you, the owner, and that’s fine. What matters is knowing where the data is stored, not leaving it lying around, and having one reflex: when in doubt, protect rather than expose. A simple site, seriously hosted, with the https padlock, already starts on solid ground.

If you want us to look at your site together to see what you really collect and set up a clear, honest privacy policy, write me. We’ll sort it out stress-free, and you’ll walk away compliant and at peace with your clients.