Law 25 modernized personal information protection in Quebec. It applies to every business, including the smallest ones, and your website is often where it applies first: that’s where you collect names, email addresses and browsing data.
This article offers practical pointers. It isn’t legal advice: for a specific situation, talk to a lawyer.
A three-step timeline
- September 2022: designating a person in charge of the protection of personal information (by default, the person with the highest authority in the business) and the duty to report confidentiality incidents.
- September 2023: most obligations, including the privacy policy, consent rules, profiling technologies and the new penalties.
- September 2024: the right to data portability, meaning people can get their information in a structured, commonly used technological format.
Penalties are serious: up to $10 million or 2% of worldwide turnover in administrative penalties, and up to $25 million or 4% in penal fines.
The checklist for your site
1. A real privacy policy
If you collect information through technological means, such as a form, you must publish a policy written in clear and simple terms. Watch out for the sample text WordPress creates at install: it talks about comments, Gravatar and user accounts, often unrelated to your site. That isn’t a compliant policy.
At a minimum, it should explain what information you collect, why, who you share it with, whether it leaves Quebec, how long you keep it and how people can exercise their rights.
2. The title and contact details of the person in charge
The law requires the title and contact details of the person in charge of protecting personal information to be published on your website. A line in your privacy policy is enough, with a concrete way to reach them.
3. Cookies and tracking tools
Tools that can identify, locate or profile a visitor, such as advertising pixels or some analytics setups, require you to inform the person and give them a way to turn those features on. In practice, that means a consent banner where non-essential cookies stay off until the visitor accepts them.
Take inventory: Google Analytics, the Meta pixel, embedded maps, YouTube videos, chat tools. Any WordPress plugin can add some without you knowing.
4. Forms that only ask for what’s needed
Only collect what you need. A contact form doesn’t need a date of birth. Also check where submissions go: many form plugins keep every entry in the WordPress database, forever. Set a retention period and delete old entries.
5. Your providers, especially outside Quebec
Host, email delivery service, newsletter tool, CRM: before sharing personal information outside Quebec, the law requires a privacy impact assessment. Know where your data lives and name your providers in your policy.
6. Security and incidents
A hacked site can become a confidentiality incident you have to report. Backups contain personal information too: they must be protected and have a retention period. Keep a register of incidents, even minor ones.
Where to start
- Replace WordPress’s sample text with a real policy.
- Add the title and contact details of the person in charge.
- Inventory your cookies and add a consent banner if needed.
- Review your forms and how long you keep submissions.
- List your providers and where they process data.
On the hosting side, I handle the technical part: server security, backups and monitoring. If you’d like a look at what your WordPress site really collects, get in touch.
Your WordPress site deserves better?
Fast, secure, closely managed hosting.