Understanding Quebec's Bill 25 and What It Means for SMEs

Bill 25, officially titled "An Act to modernize legislative provisions as regards the protection of personal information", is a major reform of Quebec's privacy laws. It strengthens personal data protection, aligns with global standards like the General Data Protection Regulation (GDPR), and applies to all businesses, including small and medium-sized enterprises (SMEs)—a fact often overlooked.

If your business collects, uses, or stores personal information, you are required to review your data practices and ensure full compliance. The law was phased in from September 2022 to September 2024, and non-compliance can result in serious penalties—up to $25 million or 4% of worldwide turnover.

Key Obligations for SMEs Under Bill 25:

1. 1. Appoint a Privacy Officer
   • Every organization must name a person responsible for personal information protection. By default, the company's director usually takes this task on, though somebody else (internal or external) can be appointed.


2. 2. Update and Publish Your Privacy Policy
   • Your policy must clearly explain:
   • Why and how data is collected
   • Who has access to it (e.g., suppliers or partners)
   • What rights do individuals have (e.g., access, rectification, withdrawal)


3. 3. Obtain Clear Consent
   • Consent must be specific and informed. For instance, online forms must include checkboxes for users to agree to data collection.


4. 4. Adopt Adequate Security Measures
   • Protect data against loss, unauthorized access, or cyber-attacks by:
   • Using strong passwords and encryption
   • Keeping systems updated
   • Restricting internal data access


5. 5. Establish Procedures for Key Legal Situations
   • Respond to access or correction requests
   • Allow consent withdrawal
   • Handle privacy complaints
   • Document and report serious data incidents to the Commission d’accès à l’information du Québec


6. 6. Conduct Privacy Impact Assessments (PIAs)
   • Required before launching new systems, projects, or transferring data outside Quebec. A PIA helps identify and manage privacy risks.


7. 7. Ensure Data Portability
   • When individuals request their information, provide it in a structured, open format like CSV, XML, or JSON—not in locked or proprietary formats like PDFs or images.

By following these steps, SMEs can ensure compliance with Bill 25, reduce legal risks, and build stronger trust with clients and partners. Taking action now protects your business and positions it as a responsible and modern player in today's data-driven world.

Legal Expertise