FAQ-214 EN - Does Law 25 apply to my small business?

Yes. Law 25 applies to any organization in Quebec that collects personal information, regardless of size. A self-employed person with a website collecting emails is affected. Obligations include: designating a privacy officer, publishing an accessible Privacy Policy, obtaining consent for non-essential data, reporting incidents to the Commission d'accès à l'information (CAI), and responding to access requests.