Quebec Law 25 for Montreal businesses: French privacy notices, consent, privacy officer, and breach reports

What to take away

Most readers of this site are not Montreal business owners. Even so, Law 25 is a useful example of online privacy practice. It shows what a clear notice should contain, why consent must be separate for each purpose, and how access, correction, deletion, and portability requests should work.

The same questions apply when you check any company's privacy notice: who is responsible, what data is collected, how long it is kept, and how to complain. Use this Quebec case as a checklist for judging privacy notices anywhere.

For readers of this site, the point is not to memorize Quebec rules. Law 25 is a concrete example of the online privacy and personal data questions that matter anywhere. It shows what a privacy notice should disclose, why consent must be separate for collection, marketing, and cookies, and how access, correction, deletion, and portability requests should work.

If you live in the United States, you can use the Montreal requirements below as a checklist when you review a privacy policy, change cookie settings, or ask a company for your data. The jurisdiction changes, but the underlying online privacy choices do not.

What Quebec Law 25 requires of a Montreal business

Quebec Law 25 (Loi 25) modernizes privacy rules for any business operating in the province, including Montreal. It applies to personal information you collect from customers, employees, and website visitors. If you run a Montreal shop, a Plateau café, or a software company in Mile End, the law reaches you.

The main duties are straightforward. You must publish a privacy notice in clear language. You must obtain consent before collecting personal information, except in narrow cases allowed by law. You must name a privacy officer and make their contact details public. You must report serious breaches to the CAI and to affected people.

Law 25 also gives people rights to access, correct, and delete their data. They can ask for portability, meaning you must hand over their data in a structured, commonly used format. You must answer requests within 30 days, with a possible extension if justified.

For a fuller picture of how collection, use, sharing, retention, and deletion fit together, see the personal data privacy guide.

The law follows the person rather than the postcode. A business with servers in Ontario that serves Montreal customers still falls under Law 25 for those customers' data. Many Montreal firms also handle employee information, which the law covers in the same way as customer records.

Quebec's business portal, Entreprises et travailleurs autonomes, is the official starting point for registration and permits: Quebec businesses portal. The Start an enterprise page sets out the registration steps: Start an Enterprise page.

Montreal's bilingual market adds a practical wrinkle. Many customers read French first, while suppliers and software vendors often work in English. Your notice has to serve both without creating two competing sets of rules. Keep one source document with two language versions, not separate policies that drift apart.

Drafting a French-language privacy notice under the Charter of the French Language

The Charter of the French Language requires that commercial publications, including privacy notices, be in French. In Montreal, this means your privacy notice must be available in French. You can offer an English version, but the French version must be at least as accessible.

This does not mean a word-for-word translation. It means the French notice must be clear, complete, and not buried behind an English-only link. Put a prominent link to the French version on your homepage and at every point where you collect personal information.

Here is a checklist for your French and English privacy notice wording:

A common mistake is to translate only the headings. The body must also be in French. If you use a translation tool, have a human review it. The CAI has stated that a notice must be understandable to a French-speaking person in Quebec.

Put the notice where people actually look: the footer of every page, the checkout screen, and any printed form. A notice hidden behind three clicks does not meet the test of clear language.

A privacy notice is not the same as an internal policy. The notice tells the public what you do with their information. The internal policy tells staff how to do it. Both documents should say the same thing.

A full notice skeleton, in order:

For a step-by-step method to build your notice, use the personal data lifecycle checklist.

Consent wording: examples for collection, marketing and cookies

Consent under Law 25 must be clear, free, and informed. It must be given for specific purposes. You cannot bundle all purposes into one checkbox. Here are example consent wordings you can adapt.

Collection for a service: "J'accepte que [Business] collecte mon nom, mon courriel et mon adresse pour traiter ma commande et livrer les produits. Je peux retirer mon consentement en tout temps." "I agree that [Business] may collect my name, email, and address to process my order and deliver products. I can withdraw my consent at any time."

Marketing: "J'accepte de recevoir des courriels promotionnels de [Business]. Je comprends que je peux me désabonner à tout moment." "I agree to receive promotional emails from [Business]. I understand I can unsubscribe at any time."

Cookies: "J'accepte l'utilisation de témoins de connexion pour analyser mon utilisation du site et personnaliser les annonces. Je peux modifier mes préférences dans les paramètres." "I agree to the use of cookies to analyze my site usage and personalize ads. I can change my preferences in settings."

These examples show the required elements: purpose, scope, and withdrawal. The CAI expects consent to be separate for each purpose. A single "I agree" for everything is not valid.

Keep a record of when and how each person consented. If someone withdraws consent, stop the processing within a reasonable time and confirm that in writing. A dated note in your customer file is enough for most small Montreal businesses.

For more on how consent fits with access, correction, deletion, and portability, see the browser privacy checklist.

Privacy officer, incident log and breach notification to the CAI

Law 25 requires you to designate a privacy officer. This person is responsible for compliance and for answering questions from the public and the CAI. Their title and contact information must appear in your privacy notice.

You must also keep an incident log. Any breach of personal information must be recorded, even if it does not meet the threshold for reporting. The log should include what happened, when, what data was involved, and what you did.

A breach must be reported to the CAI if it presents a risk of serious injury. You must also notify affected individuals. The law requires the report with diligence, which means promptly. It sets no fixed number of days, so the count starts when you have cause to believe a serious incident occurred.

The CAI's incident declaration form is on its site at cai.gouv.qc.ca. For breaches of certain obligations, the CAI can impose administrative monetary penalties of up to $10 million or 2 per cent of worldwide annual turnover, whichever is larger.

Name a backup for the privacy officer. Vacations and departures should not leave the role empty, because the CAI and the public need a contact who answers.

For a fictional walkthrough of how a request and a breach unfold, read the browser privacy guide.

Portability and deletion requests from Montreal customers

Customers in Montreal can ask you to delete their personal information. They can also ask for portability, which means you must provide their data in a structured, commonly used format. You must respond within 30 days.

Deletion requests are not absolute. You may need to keep some data for legal or accounting reasons. But you must tell the person what you kept and why. You must also inform them of their right to complain to the CAI.

Portability requests often come as CSV or JSON demands. Law 25 asks for a structured, commonly used technological format and names none, so CSV or JSON is the usual answer. You should be able to export order history, account details, and preferences on request. A PDF alone does not count as a structured format.

Verify identity before releasing data, but do not ask for more than you need. A full credit file or a health card copy is usually excessive for a simple account request.

For a checklist to manage these requests from start to finish, use the browser privacy problems.

The CAI handles complaints if a business refuses a valid request. Quebec's justice system also plays a role in enforcement. The Justice and civil status page explains the civil status framework that supports these rights.

Checking a Montreal business's registration and NEQ before you trust its notice

Before you rely on a privacy notice from a Montreal business, check that the business is registered in Quebec. The Quebec Enterprise Number (NEQ) is a unique identifier given to every registered enterprise. It appears on the public register.

A valid NEQ means the business is on file with the Registraire des entreprises, which keeps the Registre des entreprises du Québec. You can search the register by business name or NEQ at registreentreprises.gouv.qc.ca.

If a website has no NEQ and no physical address, treat its privacy notice with caution. The Quebec Enterprise Number (NEQ) page explains what the NEQ is and how to find it.

If a notice looks thin even after you confirm the registration, you can file a complaint with the CAI. The CAI publishes decisions that name businesses, so a quick search tells you whether others have raised concerns.

The Office of the Privacy Commissioner of Canada (OPC) also provides French-language resources on privacy topics. These can help you understand federal rules that may apply alongside Law 25. See the OPC privacy topics hub for guidance in French.

Common questions