Rules
How Quebec's Law 25 changes cybersecurity duties for Montreal SMEs
Quebec Law 25 cybersecurity duties go beyond PIPEDA for Montreal SMEs: security measures, breach notification, French-language policies and vendor clauses.
What to take away
- Quebec Law 25 cybersecurity rules add consent, breach notification, French-language policy duties and vendor clauses on top of PIPEDA for Montreal SMEs.
- The Commission d'acces a l'information (CAI) enforces the provincial private-sector statute, while the Office of the Privacy Commissioner of Canada (OPC) still handles PIPEDA matters.
- Breach notification under Law 25 is a two-track dutytell the CAI and tell affected individuals when there is a risk of serious injury.
- Privacy policies and notices must be in French in Quebec; a French version must be available even if you also publish English.
- Section 3.1 of the Act requires reasonable security measures, section 3.3 requires a privacy impact assessment before communicating personal information to a third person and before carrying out a project to provide a technological product or service, and confidentiality is the default.
- Practical cybersecurity controlsencryption, multi-factor authentication, logging, patching, backups and vulnerability management — are what make those duties real.
- Vendor contracts need privacy clauses, breach notice timelines, audit rights and data return or destruction terms.
- A readiness checklist should cover data mapping, consent records, incident logs, staff training and contract reviews.
What Law 25 adds on top of PIPEDA for Montreal SMEs
Quebec Law 25, the Act respecting the protection of personal information in the private sector, is the provincial statute that governs how Montreal SMEs handle personal information. It sits alongside PIPEDA, the federal private-sector law, rather than replacing it.
The Office of the Privacy Commissioner of Canada explains how federal and provincial statutes interact in its guide for businesses, PIPEDA — Your privacy responsibilities: A guide for businesses and organizations. A Montreal company with customers in Ontario and Quebec may need to meet both regimes.
The key difference is that Law 25 is a provincial law with its own regulator, the Commission d'acces a l'information (CAI). PIPEDA is enforced by the OPC. A Montreal SME that collects customer data in Quebec is primarily governed by Law 25 for those activities, while PIPEDA may still apply to cross-border commercial activity or federally regulated sectors.
For small firms, the practical effect is that privacy compliance is no longer just a federal question. The Quebec business hub is the entry point for provincial obligations, including privacy duties that apply to companies registered or operating in Quebec. If you run a Montreal shop, clinic or agency, you are in scope.
The law also changes how you think about cybersecurity. Privacy is not only about consent forms. It covers how you protect data, how you detect breaches, how you notify people and how you manage vendors. Section 3.1 of the Act requires reasonable measures to ensure the protection of the personal information you collect, use, hold or communicate, taking into account its sensitivity, the purposes it serves, its quantity and distribution and the medium on which it is stored. That is why the CAI expects documented security measures, not just good intentions.
Montreal's bilingual market adds a layer. You may serve customers in French and English, but the law's language rules are not symmetric. French is the default for privacy notices, and you need to be able to show that your notices are available in French. That affects website design, onboarding flows and paper forms.
If you already follow a PIPEDA compliance checklist, you have a head start. But Law 25 adds specific duties that a federal checklist will not cover, including breach records, privacy impact assessments for certain projects and French-language requirements. Treat the federal checklist as a baseline, not a finish line.
The cybersecurity duties behind Law 25's security requirement
Law 25 is not only a consent and policy statute. Section 3.1 of the Act requires an enterprise to implement reasonable measures to ensure the protection of the personal information it collects, uses, holds or communicates. What counts as reasonable depends on the sensitivity of the information, the purposes it serves, its quantity and distribution and the medium on which it is stored.
Confidentiality is the default. Personal information must be protected without the individual having to ask for it, and only what is necessary for a stated purpose may be collected, used or communicated. Once the purposes are met, the information must be destroyed or anonymized, subject to any retention duty imposed by law.
Section 3.3 adds the privacy impact assessment. A Montreal SME must conduct an assessment before communicating personal information to a third person and before carrying out a project to provide a technological product or service. The CAI's privacy impact assessment guide sets out the usual steps: describe the project, map the information flows, identify the risks, and record the safeguards chosen and who approved them.
The security duty is where cybersecurity becomes concrete. The measures that make section 3.1 real for a small firm are:
- encryption of personal information at rest and in transit;
- multi-factor authentication for administrative and remote access;
- logging and audit trails that show who viewed or exported personal data;
- routine patching and a recurring check for known vulnerabilities;
- tested backups with a documented recovery step;
- role-based access, so staff see only the records they need;
- an incident response plan naming who investigates, who notifies and who keeps the register.
The point is not to buy every tool. It is to be able to show, in writing, which measures you took, why they were reasonable for the data you hold and how you verify that they still work.
Consent, transparency and privacy policy duties the CAI expects
Consent under Law 25 must be clear, free and informed, and it must be given for specific purposes. The CAI expects businesses to collect only what is necessary for a stated reason. Blanket consent for undefined future uses does not meet the standard. For Montreal SMEs, that means your sign-up forms, loyalty programs and marketing lists need a review.
Transparency is the companion duty. You must tell people what you collect, why, how long you keep it and who you share it with. That information belongs in a privacy policy that is easy to find and easy to read.
The CAI has signalled that privacy policies should be written so an ordinary reader can follow them, not as legal boilerplate.
Quebec privacy policy requirements also include a designated person responsible for the protection of personal information. For a small firm, that may be the owner or an operations manager. The point is that someone is accountable, and staff know who to ask. This is not a ceremonial role; it is the person who handles access requests and incident decisions.
Consent records matter. If a customer asks how they agreed to something, you should be able to show when and how. A spreadsheet or a field in your CRM can be enough for a small firm. What matters is that the record exists and is retrievable. Without it, you cannot demonstrate compliance.
Access and correction rights are part of the same package. Individuals can ask to see their data and ask for corrections. Under the Act, you must answer an access request in writing within 30 days of receiving it, and you need a process to receive, log and answer those requests. A shared inbox with a clear owner is a workable start.
Employee data is also covered. Quebec's Hiring and managing staff guidance points to privacy duties that apply to employers, from recruitment files to payroll and performance records. Your HR processes are part of your privacy program, not a separate world.
Access controls are part of consent in practice. If too many staff can see customer records, consent promises become hard to keep. A review of identity and access across your systems is a sensible first technical step, because it limits who can use data beyond the purpose it was collected for.
Breach notification and incident records under Quebec Law 25
Law 25 breach notification has two parts. You must notify the CAI when a breach presents a risk of serious injury to affected individuals. You must also notify the individuals themselves when there is such a risk. The threshold is risk of serious injury, which can include identity theft, financial loss, reputational harm or sensitive data exposure.
Timing matters. The statutory standard is notification without unreasonable delay once you become aware of a breach. The CAI receives reports through its online confidentiality incident declaration form, which asks for the date of the incident, the data involved, the people affected and the measures taken. A practical internal target for many Montreal SMEs is 72 hours from discovery to file that form, with individuals told as soon as the risk is confirmed.
The CAI can impose administrative penalties up to $10 million or 2% of worldwide turnover for a legal person, and penal fines can reach $25 million for repeat offences. For a small firm, that means you cannot wait for a perfect assessment. You need a triage process that starts the clock and documents decisions as they are made.
Incident records are a separate duty. You must keep a register of all breaches, even those that do not meet the notification threshold. The register should record what happened, when it was discovered, what data was involved, what you did and who was notified. The CAI can ask to see it.
This is where preparation pays off. A written incident response plan tells staff who to call, what to preserve and how to communicate. Without one, small firms tend to improvise, and improvisation is what turns a contained incident into a reportable one.
Breach notification is not only a privacy task. It has operational, legal and reputational parts. You may need to involve your insurer, your lawyer and your IT provider. Decide in advance who does what, and keep the contact list current. A one-page plan beats a 40-page binder nobody reads.
Training is part of the duty too. Staff need to recognise a suspected breach and know how to report it internally. A short annual session, plus a clear reporting channel, is enough for most Montreal SMEs. The point is speed, not sophistication.
French-language policy and notice requirements in practice
The Charter of the French Language, as amended by Bill 96, applies to privacy notices. A French-language privacy policy is the default for Quebec consumers and employees. You cannot treat English as the primary text and French as a courtesy translation.
In practice, this affects your website, your app, your forms and your contracts. A Montreal SME with an English-only privacy page is exposed. The fix is not complicated: have the policy translated by someone who understands privacy terms, then keep both versions in sync when you update either one.
Consent notices and breach notifications also need French. If you send a breach notice to a Quebec customer, it should be in French unless the customer clearly prefers another language. The same applies to marketing consent and to notices about data sharing with third parties.
Language and content are linked. A translation that drops key details is not a compliant translation. Review the French text for accuracy, not just fluency. If your translator is not a privacy specialist, have someone check the terms that carry legal weight.
Keep a record of when each version was published. If the CAI asks, you should be able to show that the French version was available at the relevant time. Version control is a small habit with outsized value.
Quebec's Justice and civil status pages are a useful reference point for how provincial obligations are framed, including the civil-law context that shapes privacy duties. They are not a substitute for legal advice, but they help you ask better questions.
Vendor and service provider contracts: the clauses to add
Most Montreal SMEs share personal information with vendors: payroll providers, cloud hosts, marketing platforms, IT support and payment processors. Law 25 expects you to have written agreements that protect that data. A handshake or a standard terms-of-service click is not enough.
Start with a vendor risk assessment before you sign. Understand what data the vendor will see, where it is stored, who can access it and what happens if the relationship ends. The contract should reflect what you learned.
Here is a vendor contract checklist you can adapt. It covers the clauses the CAI expects to see in some form, depending on the service and the data involved.
- Purpose limitationthe vendor may use the personal information only for the services you hired it for.
- Security measuresthe specific safeguards the vendor must maintain, such as encryption, access controls and logging.
- Breach notificationa set number of hours for the vendor to tell you about an incident, and what it must tell you.
- Notification to individualswhether the vendor notifies affected people itself or leaves that to you.
- Sub-processor approvalno new subcontractor without your written consent.
- Audit or information rightsyour right to ask for evidence that the safeguards are in place.
- Data return or destructionwhat happens to the data when the contract ends, and how destruction is confirmed.
- Assistance with access requeststhe vendor must help you answer individuals who ask to see or correct their data.
These clauses are not exotic. Many vendors already accept them. The problem is that small firms rarely ask, and vendors rarely volunteer. Put them in your template and use the template every time.
A worked example makes this concrete. Suppose a Montreal clinic uses a cloud booking tool hosted in the United States. The clinic collects names, contact details and appointment reasons. Under Law 25, the clinic remains responsible for that data.
The contract should name the data types, require breach notice within a set number of hours and require deletion on termination. The clinic should also record why it chose that vendor and what safeguards it verified. If a breach occurs, that record shows the clinic did not simply outsource its obligations.
A Law 25 readiness checklist for a Montreal small firm
Use this checklist as a starting point. It is not a legal opinion, and a privacy lawyer can help you prioritise. The goal is to close the obvious gaps before a complaint or a breach forces the issue.
- Map where personal information lives in your systems, spreadsheets and paper files.
- Record consent for each purpose and keep it retrievable.
- Designate a person responsible for privacy and publish their contact.
- Write a French privacy policy that matches your actual practices.
- Set a breach response plan with a 72-hour internal notification target.
- Keep an incident register for all breaches, even minor ones.
- Review vendor contracts for privacy clauses, breach notice and deletion terms.
- Train staff on spotting and reporting a suspected breach.
- Check access controls so only necessary staff can see personal data.
- Review and update the program at least once a year.
The order matters less than starting. Most Montreal SMEs will find that consent language, French policy text and vendor clauses are the quickest wins. Breach records and incident planning take a little longer but pay off when something goes wrong.
Training should focus on your systems and your data, not on generic certificates. A sceptical eye on any training vendor helps you avoid buying a badge instead of a capability.
If you operate in more than one province, check how your obligations stack. The OPC's Privacy for businesses guidance remains relevant for PIPEDA-covered activity, and provincial regulators such as the CAI apply their own rules. A Montreal firm selling into Ontario or the United States should map both sets of duties.
Finally, revisit the program each year. Law 25 is being brought into force in stages, and the CAI's expectations will sharpen as it publishes guidance and decisions. A short annual review, with the checklist above, keeps you from falling behind.
