7-minute read · by Philippe, who runs a home-service business in Québec
Law 25 modernized privacy protection in Québec. For a small service business it mostly touches three places: your website, your quote form and the way you keep customer contact details.
This is not legal advice. It is what a business owner needs to know to put a site in order, and what I did on mine. For a specific case, Québec’s Commission d’accès à l’information (CAI) publishes clear guides.
What the law asks of a small business
- A person in charge of personal information. By default it is the person with the highest authority in the business, often you. Their title and contact details must be published on your website.
- A privacy policy in plain language, published on the site, saying what you collect, why, and whom to write to for access or correction.
- Clear consent when collecting information, used only for the stated purposes.
- A register of privacy incidents, and notice to the CAI and affected people when an incident carries a risk of serious harm.
Law 25 website checklist
- The privacy policy is reachable from every page, usually in the footer.
- Cookies and tracking tools that can identify, locate or profile a visitor are off by default. Google Analytics or the Facebook pixel should not fire before the person accepts.
- The quote form asks only what the quote needs: name, a way to reach them, job address, the need.
- The name and contact details of the person in charge are published.
- Data hosted outside Québec (most software is) requires a privacy impact assessment before the transfer. It is a document you do once, not a roadblock.
Texts and emails
Messages to customers about a service they requested (confirmation, reminder, invoice) are part of the service. Prospecting messages fall under a federal law, Canada’s anti-spam legislation (CASL), which requires identifying your business in every message.
The most common mistakes
- A policy copied from another site, describing services you do not offer.
- A cookie banner that informs but blocks nothing.
- Customer details in a shared file with no password.
The websites I deliver with Crescendo include a privacy policy, a footer link to it and a form that asks only what is needed. See websites.