Home / Resources / Checklist + guide

Law 25: check your digital tools and your use of AI

Billing software, cloud storage, website forms, AI assistants: every tool that touches personal information has to respect the law. Answer the checklist, see your score and the fixes to make first. A printable PDF guide comes with the tool.

Check my tools

What's inside the guide

  • 1
    What the law changes for a small businessThe obligations that most often affect small companies, in plain language.
  • 2
    The printable checklist19 points with checkboxes in 6 groups, from the designated officer to destroying data.
  • 3
    The registers to keepIncidents, access requests, vendors: the tables to fill in so everything lives in one place.
  • 4
    8 questions for a vendorHosting, subcontractors, retention, logs, right of access: to ask before you sign or renew.
  • 5
    Privacy policy and incidentsWhat the policy must cover, and the steps to follow when an incident happens.
  • 6
    AI: what you never pasteThe information to keep out of public tools, and where to start.

Who this is for

Owners and managers of Québec small and mid-size businesses (clinics, construction, retail, transport, professional services) who use software, cloud services or AI tools with information about customers, patients or employees.

This guide is not legal advice.

It helps you spot the most common gaps and prepare your questions. It does not replace a lawyer or a privacy advisor. Depending on your sector and situation, other rules may apply: validate with an advisor. Penalties can reach $10M or 2% of worldwide turnover (administrative monetary penalties), and $25M or 4% (penal fines).

Frequently asked questions

Does Law 25 apply to a small business?

Generally yes, as soon as the business collects, uses or keeps personal information as part of its activities in Québec. There is no automatic exemption for small businesses. Validate your case with an advisor.

What does "Law 25" mean?

It is the common name of the Act to modernize legislative provisions as regards the protection of personal information, which amended several Québec laws, including the private sector privacy act.

Are my answers sent anywhere?

No. Your answers stay in your browser. Only your contact details, asked once to display the result and the guide, are saved.

Does a high score mean I am compliant?

No. The score is a marker to target your fixes. Only an analysis of your real situation can conclude.

A tool or an AI project to review?

Tell us what you use or want to set up. We give you an honest read, including when the right answer is not to use it with that data.

Talk to us