Quebec Law 25 compliance for small and mid-sized businesses

Yes. Law 25 applies to virtually every private-sector enterprise in Quebec that collects, holds or uses personal information, regardless of size — there is no employee-count exemption. The core obligations have been in force since September 2023 — and the first wave, including naming a privacy officer and reporting serious confidentiality incidents, since September 2022. Smaller businesses simply need to scope the effort to their size, which is exactly what we help with.

Law 25 carries some of the toughest privacy penalties in Canada. The Commission d’accès à l’information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover for the most serious offences — whichever is higher. The law also created a private right of action for damages. The practical risk for an SMB is usually a complaint or a reported breach that exposes missing governance, which is why having the basics in place matters.

An EFVP — évaluation des facteurs relatifs à la vie privée, or privacy impact assessment — is a structured review of the privacy risks of a project. Under Law 25 you must conduct one before acquiring, developing or overhauling an information system that handles personal information, and before transferring personal information outside Quebec. We run the EFVP, document the risks proportionate to the project, and give you the mitigation steps and the record to keep on file.

Yes. If you’d rather not assign the role internally, we can serve as your outsourced privacy officer — the named Responsable de la protection des renseignements personnels — handling requests, incident assessments, the incident register and ongoing governance. It pairs naturally with our virtual-CISO service, giving you privacy and security leadership at a fraction of a full-time hire, in French and English.

There’s no flat rate, but the market is narrower than you’d think. For an SMB, a gap-and-readiness review is typically a fixed fee between $3,000 and $6,000, in Canadian dollars; a full compliance program — assessment, policies, registers, privacy impact assessments (EFVP) and implementation support — generally runs $6,000 to $20,000, depending on the volume and sensitivity of the personal information you hold and whether you outsource the privacy-officer (RPRP) role. Quebec business press has reported bills of $30,000 to $40,000 for complex firms with heavy data footprints. An SMB that already has policies and a named officer has far less ground to cover than one starting from zero — which is why we begin with a short gap review, then give you a clear fixed fee with no surprises, sized to your situation.

Not always — and we’ll tell you plainly when that’s your situation. If your data footprint is small (a client list, employee files, ordinary office tools) and someone internal genuinely owns the file, you can do a lot yourselves: name the officer, publish the policy, keep the register. A Law 25 compliance consultant earns the fee when the work turns technical or the stakes climb — running a proper gap review, conducting EFVPs before new systems or transfers outside Quebec, building registers that hold up to a complaint, and carrying the RPRP duties when nobody inside can take them on. The honest test is time and ownership: if no one in your business has both, outside help costs less than getting it wrong.

Subsidized cybersecurity and Law 25 support has been available to Quebec SMBs through the province’s network of college technology-transfer centres (CCTT) — for example CyberQuébec, affiliated with Cégep de l’Outaouais and funded by the Government of Quebec. Specific programs change over time (the MaLoi25 program, for instance, ended in 2025), so we help you identify what’s currently available and confirm your eligibility, then carry out the compliance work itself — EFVP, governance and privacy officer.