Quebec Law 25 and Your Website: What Businesses Need to Know
Quebec’s Law 25 introduced some of the strictest privacy requirements in Canada, with real penalties. Here is what it means for your website, your data handling, and your hosting decisions.
What Law 25 Is
Quebec's Law 25 (formerly Bill 64) modernized the province's private-sector privacy law and phased in a set of obligations that are, in several respects, stricter than PIPEDA. It applies to organizations that collect, hold, use, or communicate personal information of individuals in Quebec — regardless of where the business itself is located.
If you have customers, users, or contacts in Quebec, Law 25 can apply to you even if your company is based in another province. This guide is a plain-language overview of what it means for a website operator. It is not legal advice; for specific obligations, consult a privacy professional.
Why It Matters More Than People Expect
Two features make Law 25 hard to ignore:
Real penalties. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater. These are not theoretical maximums attached to a toothless law — the framework was built for enforcement.
Broad reach. Because it follows the individual rather than the business location, a company outside Quebec that serves Quebec residents can fall within scope.
Key Requirements That Affect Your Website
Consent and transparency. You must be clear about what personal information you collect, why, and how it will be used. Consent must be clear, free, and informed, and requested for specific purposes — not buried in a catch-all agreement.
Privacy by default. Technology products and services that collect personal information must offer the highest privacy settings by default, without the user having to configure anything.
A designated privacy officer. Organizations must have someone responsible for privacy compliance, and their role or contact must be published — commonly on the website.
Privacy impact assessments. Certain projects, including acquiring or developing information systems that handle personal information, require an assessment before proceeding.
Rights for individuals. People have rights to access, correct, and — in defined circumstances — request de-indexing or deletion of their personal information. Your website and processes need to be able to honour these requests.
Breach reporting. Confidentiality incidents that present a risk of serious injury must be reported to the Commission d'accès à l'information and to affected individuals, and logged.
The Cross-Border Data Transfer Rule
This is the part most directly tied to hosting. Before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment that considers, among other things, the sensitivity of the information and the legal framework of the destination jurisdiction.
In practice, storing Quebec residents' personal information on servers outside Quebec — for example, on US-based hosting — is not automatically prohibited, but it does trigger an assessment obligation and raises the question of whether the destination offers adequate protection. Keeping data within Quebec, or at least within Canada, removes a layer of that analysis and simplifies your documentation.
A Practical Website Checklist
- [ ] Publish a clear, current privacy policy describing what you collect and why
- [ ] Name a privacy officer and publish their role or contact
- [ ] Make consent requests specific and unbundled from general terms
- [ ] Default to the most privacy-protective settings
- [ ] Provide a working process for access, correction, and deletion requests
- [ ] Keep cookie and tracking consent genuine, not pre-checked
- [ ] Document where personal information is stored and where it is transferred
- [ ] Assess cross-border transfers before they happen
- [ ] Have a breach response and notification plan in writing
- [ ] Retain records only as long as you have a purpose for them
How Hosting Fits In
Hosting does not make you Law 25 compliant — compliance is about your practices, consent, documentation, and internal processes. But your infrastructure choices affect how much work compliance takes.
Keeping personal information on Canadian infrastructure, with Canadian backups, reduces the cross-border transfer analysis and strengthens your position on "adequate protection." It also makes your privacy documentation simpler and more defensible: you can state plainly where the data lives instead of tracing it through foreign regions and subprocessors.
TransPark operates exclusively in Canada, including backups, which keeps the data-residency portion of your Law 25 posture straightforward. The rest — consent, policies, a designated officer, and honouring individual rights — remains your organization's responsibility, and no host can do it for you.
The Bottom Line
Law 25 raised the bar for privacy in Quebec, with penalties serious enough to demand attention and reach broad enough to catch out-of-province businesses. For your website, focus on clear consent, published privacy roles, honouring individual rights, and documenting where data goes. Canadian hosting will not check every box, but it removes one of the harder ones — cross-border transfer risk — and makes the rest easier to defend.