Quebec Law 25 compliance for small and mid-sized businesses

Yes. Law 25 applies to virtually every private-sector enterprise in Quebec that collects, holds or uses personal information, regardless of size — there is no employee-count exemption. The core obligations have been in force since September 2023 — and the first wave, including naming a privacy officer and reporting serious confidentiality incidents, since September 2022. Smaller businesses simply need to scope the effort to their size, which is exactly what we help with.

Law 25 carries some of the toughest privacy penalties in Canada. The Commission d’accès à l’information can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover for the most serious offences — whichever is higher. The law also created a private right of action for damages. The practical risk for an SMB is usually a complaint or a reported breach that exposes missing governance, which is why having the basics in place matters.

An EFVP — évaluation des facteurs relatifs à la vie privée, or privacy impact assessment — is a structured review of the privacy risks of a project. Under Law 25 you must conduct one before acquiring, developing or overhauling an information system that handles personal information, and before transferring personal information outside Quebec. We run the EFVP, document the risks proportionate to the project, and give you the mitigation steps and the record to keep on file.

Yes. If you’d rather not assign the role internally, we can serve as your outsourced privacy officer — the named Responsable de la protection des renseignements personnels — handling requests, incident assessments, the incident register and ongoing governance. It pairs naturally with our virtual-CISO service, giving you privacy and security leadership at a fraction of a full-time hire, in French and English.

There’s no flat rate — the cost turns on the size of your organization, the volume and sensitivity of the personal information you hold, how mature your current governance is, and whether you outsource the privacy-officer (RPRP) role or keep it in-house. An SMB that already has policies and a named officer has far less ground to cover than one starting from zero. We begin with a short gap review to frame the work, then give you a clear fixed fee with no surprises, sized to your situation.

Subsidized cybersecurity and Law 25 support has been available to Quebec SMBs through the province’s network of college technology-transfer centres (CCTT) — for example CyberQuébec, affiliated with Cégep de l’Outaouais and funded by the Government of Quebec. Specific programs change over time (the MaLoi25 program, for instance, ended in 2025), so we help you identify what’s currently available and confirm your eligibility, then carry out the compliance work itself — EFVP, governance and privacy officer.