Law 25 (the Act to modernize legislative provisions as regards the protection of personal information) applies to every business in Quebec, whatever its size — including a three-employee installation company that keeps its customers in an Excel file. Here is, without jargon, what it requires and how to comply without spending your evenings on it.
What counts as "personal information" for an installer
Your customers' names, addresses, phone numbers and email addresses. The maintenance history of a unit tied to an address. Photos of a job site showing the inside of a house. Signatures on a work order. In other words: almost your entire registry.
The obligations, in the order you will meet them
- Designate a person in charge of the protection of personal information. By default, that is the owner. Their title and contact details must be published (website, or failing that, provided on request).
- Publish a privacy policy in plain terms: what data you collect, why, how long you keep it, who you entrust it to (your software), and how a customer exercises their rights.
- Collect clear consent for any use that is not obvious. Invoicing and servicing a unit is obvious; sending a newsletter is not. Consent gets documented: who, when, for what.
- Answer customer requests: access to their data, correction, withdrawal of consent, and erasure (the "right to be forgotten" when the data is no longer necessary). The response deadline is 30 days.
- Keep a register of privacy incidents (lost file, email sent to the wrong customer, hacking) and, if the risk of harm is serious, notify the Commission d'accès à l'information and the people concerned.
- Frame your subcontractors: the software that hosts your customers must guarantee data protection by contract. Ask where the data is hosted and what happens if you leave.
- Destroy or anonymize data that no longer serves a purpose. A customer who left fifteen years ago does not need to stay in your named file.
The penalties are real — administrative penalties and fines that can reach significant amounts for serious breaches — but the spirit of the law is reasonable for a small business: know what you keep, why, say it clearly, and answer when a customer asks. This is not legal advice; the website of the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) publishes guides for small businesses.
Compliance that fits in an afternoon
- Write your policy (one page is enough) and put it on your website or hand it out with your quote.
- Name the person in charge (you) in that policy.
- Note marketing consents at the moment you get them — a "yes, on …" field in the customer file is enough.
- Plan how you will export a customer's data if they ask, and how you will erase it.
- Keep a list of your software tools and what they host.
Byrsia builds these obligations in: a privacy policy generated for your company, a consent register, one-click export of a customer's data, anonymization or complete deletion, an incident register, and customer requests from their portal — with a ticket for you.
See how Byrsia handles Law 25Published on 2026-09-20 · This guide is informative and general; it replaces neither the manufacturers' documents nor legal or accounting advice.