A reservation book on a restaurant counter holds names, cell numbers and, sometimes, a note like “peanut allergy, table 4.” Under Law 25, that book is a file of personal information, and part of what it contains relates to health.

If you run a restaurant, a garage, a hair salon or a construction company, you may have filed Law 25 under “software companies’ business.” That is understandable: the discussion is about information systems and hosting outside Quebec. The Act itself names no sector. It covers personal information, and every business has some.

What the Act says

In 2021, Law 25 amended the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). Its section 1 sets out its scope: personal information that a person collects, holds, uses or communicates in the course of carrying on an enterprise. No sector is named. There is no threshold based on size or revenue.

The word “enterprise” has the meaning given in article 1525 of the Civil Code of Québec: an organized economic activity, commercial or not, that consists of producing or administering property or providing services. On its page about the scope of the Act (in French), the Commission d’accès à l’information (CAI) gives examples that include a self-employed worker’s sole proprietorship, a business corporation and a general partnership. For a non-profit organization, it calls for a case-by-case analysis.

Under section 2, personal information is any information that relates to a natural person and allows that person to be identified, directly or indirectly. The CAI points out that the information does not have to be filed under the person’s name. And section 1 covers every medium: written, graphic, taped, filmed, computerized. The paper book counts as much as the database.

Where personal information sits in an ordinary SME

The situations below are typical examples, not real cases.

A construction contractor prepares quotes with the owners’ names, the address of the job site and their phone numbers. The quote request form on the contractor’s website collects the same data, which lands in their email inbox.

A hair salon books appointments in online software. Client files (name, phone number, colour history) are stored on the provider’s servers, which are not necessarily in Quebec.

A garage writes the owner’s name, phone number and the vehicle identification number on every work order. It may also have cameras in the yard. An image in which someone can be recognized is personal information in visual form.

An accounting firm receives tax returns, bank statements and social insurance numbers. The CAI lists a person’s financial situation among sensitive information (in French), along with health.

And every one of these businesses has employee files: social insurance number, void cheque for direct deposit, emergency contact, doctor’s notes. There is the newsletter subscriber list, the Excel customer file shared across three computers, the point-of-sale system that keeps purchase history, the emails.

One qualification. Section 1 exempts from part of the rules on collection and communication the information tied to a person’s duties within an enterprise: their name, their title, and the address, email address and phone number of their workplace. So the contact file for the purchasing manager at your lumber supplier is not treated like a private individual’s. The personal cell number of the customer having their kitchen redone does not benefit from this exception.

One last point: handing the data to software hosted elsewhere does not take it outside the Act. According to the CAI, the Act also covers information that a third party keeps for you.

The four obligations to look at first

Our detailed article on Law 25 and SMEs goes through all the obligations, their effective dates and the penalties. For an SME whose trade has nothing to do with technology, four of them deserve your attention before the others.

The first is knowing who is in charge. Under section 3.1, the person in charge of the protection of personal information is, by default, the person exercising the highest authority in the business: in an SME, often the owner or the president. This person may delegate the function in writing, in whole or in part. The title and contact information of the person in charge are published on the business’s website.

The second concerns confidentiality incidents. A company phone lost with customer contacts on it, a quote sent to the wrong recipient, a former employee who still opens the shared file: these are incidents. Section 3.5 requires reasonable measures to reduce the risk of injury and to prevent it from happening again. If there is a risk of serious injury, the CAI and the persons concerned must be notified. Every incident, even a minor one, goes in a register (section 3.8).

The third is written rules. Section 3.2 requires governance policies and practices that cover, among other things, keeping and destroying the information, the roles of staff members and the handling of complaints. They must be proportionate to the nature and scope of the business’s activities. In our view, a four-chair salon can meet this with a short, clear document: how long inactive client files are kept, who has access to employee files, how old work orders are destroyed. The CAI notes that once the purposes have been achieved, the information is destroyed securely or anonymized (in French), subject to any retention period imposed by another law.

The fourth concerns your suppliers outside Quebec. Before communicating personal information outside Quebec, or entrusting someone outside Quebec with keeping or using it on your behalf, section 17 requires a privacy impact assessment (PIA). Appointment software, an online point-of-sale system, a newsletter service or payroll may fall into this category. The assessment takes into account, among other things, the sensitivity of the information and the legal framework of the place where it is going. The communication also requires a written agreement.

Where to start

Walk through the business. Note where personal information is kept (filing cabinets, computers, cell phones, online software), who has access to it and, for each piece of software, where the data is hosted. The provider’s contract or customer service can tell you.
Designate the person in charge. If it is not you, make the delegation in writing. Add their title and an email address to your website.
Open the incident register. A spreadsheet is enough to start.
Find what you keep for no reason: résumés from candidates five years ago, void cheques from former employees, old reservation books. Before destroying anything, check with your accountant the retention periods that other laws impose on you, in tax matters especially.
For each service hosted outside Quebec, plan a PIA, and do it before signing with your next provider.

The CAI publishes information pages for businesses (in French), written for non-lawyers. For a specific situation (an incident, a supplier abroad, cameras that film employees), consult a lawyer or a privacy consultant. This article is for information only; it is not legal advice.

Souverain Technologie works with Quebec SMEs on choosing and hosting their digital tools. If your walk-through raises questions about where your data is, you can write to us.

Sources

Act respecting the protection of personal information in the private sector, CQLR, c. P-39.1, ss. 1, 2, 3.1, 3.2, 3.5, 3.8 and 17. Accessed October 16, 2026.
Civil Code of Québec, art. 1525. Accessed October 16, 2026.
Commission d’accès à l’information du Québec, Champ d’application de la Loi (in French). Accessed October 16, 2026.
Commission d’accès à l’information du Québec, Qu’est-ce qu’un renseignement personnel ? (in French). Accessed October 16, 2026.
Commission d’accès à l’information du Québec, Conservation et destruction des renseignements personnels (in French). Accessed October 16, 2026.
Commission d’accès à l’information du Québec, Information pour les entreprises et organisations privées (in French). Accessed October 16, 2026.