Plain-language Quebec Law 25 and PIPEDA compliance checklist for small businesses: consent, privacy policy, data residency and breach reporting.
Yes. Law 25 applies to every private-sector business operating in Quebec that collects personal information, regardless of size. There is no small-business exemption.
Administrative monetary penalties can reach $10 million or 2% of worldwide turnover, and penal fines can be higher. For small businesses the practical risk is complaints, orders and reputational damage — which a short checklist avoids.
These guides are free. If you’re in Quebec and want it set up properly, IT Cares does it on-site.
Talk to IT Cares →