Law 25: the 5 things your website must have

Since September 2023, most obligations under Law 25 (Québec’s law modernizing the protection of personal information) are in force. Your website is often the first place where you collect personal information, so it’s the first place people look.

Here are the 5 things to check.

1. A clear, easy-to-find privacy policy

If your website collects personal information (contact form, booking, newsletter), you must publish a privacy policy written in plain language. It should explain:

what information you collect;
why you collect it;
who you share it with (your service providers, for example);
how long you keep it;
how a person can access it, have it corrected or withdraw consent.

A link in the footer of every page is the most common practice.

2. The name of your person in charge of personal information

Every business has a person in charge of the protection of personal information. By default, it’s the person with the highest authority in the company, but the role can be delegated in writing. That person’s title and contact information must be published on your website.

Technologies that can identify, locate or profile a visitor (some advertising or analytics cookies, for example) must be turned off by default. Visitors must be able to turn them on themselves.

In practice, a cookie banner with everything pre-checked isn’t enough.

💡 Our approach: our websites use cookie-free visitor analytics (Plausible). No banner is needed for these statistics, and your visitors aren’t tracked from site to site.

4. Forms that collect the bare minimum

Only ask for what you really need. For a contact form, that’s often a name, an email and a message. State what the information will be used for, and get clear consent (an unchecked checkbox, for example).

5. A plan for incidents

If information collected through your website is compromised (a hacked form, a database leak), you must keep an incident register. If the incident poses a risk of serious injury, you must also notify the Commission d’accès à l’information and the people affected.

That’s another reason to choose a website without vulnerable plugins: fewer ways in, fewer incidents.

What if I do nothing?

Law 25 provides for administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and even higher penal fines. For a small business, though, the most concrete risk is losing your clients’ trust.

Summary

Item	Where on the website?
Privacy policy	Link in the footer
Person in charge of personal information	In the policy, with contact details
Tracking cookies off by default	Consent banner, if applicable
Minimal forms with consent	Every form
Incident register	Internal

Every Balise Studio website includes these basics at no extra cost. Want to know where your current website stands? Get your free audit.

This article is for information purposes only and does not constitute legal advice. For your specific situation, consult a legal professional or the website of the Commission d’accès à l’information.