Quebec’s Law 25: What It Means for Your Small Business’s Passwords

Since the reform known as Law 25, many Quebec small-business owners have asked whether the law now requires a minimum password length, mandatory multi-factor authentication (MFA) or a password change every 90 days. The short answer is no. The law does not set technical rules like these. Instead, it requires you to protect the personal information you hold with reasonable measures, name a person in charge, document your practices and handle confidentiality incidents.

In a small company, much of that personal information sits behind a handful of accounts: email, accounting software, payroll, cloud storage and online banking. Securing those accounts is one of the most direct ways to meet your obligations.

This guide is general information, not legal advice. For your specific situation, read the official sources listed below or consult a lawyer.

1. What Law 25 is and when it took effect

“Law 25” is the common name for the Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, chapter 25). For businesses, its main effect was to amend the Act respecting the protection of personal information in the private sector (chapter P-39.1), which is overseen by the Commission d’accès à l’information (CAI).

The new provisions came into force in stages:

• September 22, 2022: a person in charge of the protection of personal information, a register of confidentiality incidents, and notice to the CAI and affected people when an incident presents a risk of serious injury.
• September 22, 2023: most of the remaining provisions, including the duty to establish and publish governance policies and practices.
• September 22, 2024: the right to data portability, which lets a person obtain their computerized information in a structured, commonly used technological format.

All of these obligations apply today, whatever the size of your business.

2. Reasonable measures, not a fixed recipe

Section 10 of the Act requires anyone carrying on an enterprise to take the security measures necessary to protect personal information. Those measures must be reasonable given the sensitivity of the information, the purposes for which it is used, its quantity and distribution, and the medium on which it is stored.

In other words, what is expected depends on what you hold. A shop that keeps only customer email addresses has a different profile from a bookkeeping firm that stores social insurance numbers, bank statements and tax returns. The Act does not provide a list of technical controls. It is up to you to choose measures you can defend and to explain why they fit your situation.

For most small businesses, unique passwords, MFA on sensitive accounts and prompt removal of unneeded access are among the easiest measures to justify.

3. The duties that touch your accounts

A person in charge of the protection of personal information

Under section 3.1, the person exercising the highest authority in the enterprise acts by default as the person in charge of the protection of personal information. In a small business, that is usually the owner or president. All or part of the function can be delegated in writing. The person’s title and contact information must be published on the company website or, if there is no website, made available by other appropriate means.

For account security, this person is the natural decision-maker: they approve access rules, exceptions and the response to incidents.

Governance policies and practices

Section 3.2 requires governance policies and practices for personal information. They must, in particular, cover how information is kept and destroyed, define staff roles and responsibilities throughout the information’s life cycle and set out a complaint-handling process. They must be proportionate to the nature and scope of your activities, approved by the person in charge and described in simple, clear language on your website.

The Act does not mention a password policy by name, but one fits naturally into this framework: it states who can access what, how accounts are protected and what happens when someone leaves.

A register of confidentiality incidents

Under section 3.6, a confidentiality incident is access, use or communication of personal information not authorized by law, or its loss or any other breach of its protection. Section 3.8 requires every enterprise to keep a register of these incidents, including those that do not present a risk of serious injury. The Regulation respecting confidentiality incidents sets out what each entry contains: the information involved, the circumstances, the relevant dates, the number of people affected, the risk assessment, any notices sent and the measures taken. Entries must be kept up to date and retained for at least five years after you became aware of the incident. The CAI can ask for a copy.

Notifying the CAI and affected people

Under section 3.5, as soon as you have reason to believe an incident has occurred, you must take reasonable measures to reduce the risk of injury and to prevent similar incidents. If the incident presents a risk of serious injury, you must promptly notify the CAI and the people whose information is involved. To assess that risk, section 3.7 asks you to consider, in particular, the sensitivity of the information, the anticipated consequences of its use and the likelihood that it will be used for injurious purposes, and to consult your person in charge.

4. Checklist: turning the law into concrete steps

The steps below are not an official list. They are common practices that help a small business show it has taken reasonable measures for its accounts.

1. Inventory the accounts that reach personal information: email, accounting, payroll, CRM, shared storage and banking. Record an owner and the sign-in method for each one.
2. Use a unique password for every service, stored in an approved password manager: reuse turns a leak on one website into access to your mailbox. Create secrets with the password generator and spot duplicates with the local password audit.
3. Turn on MFA first for email, accounting and banking: email is often the reset route for every other account. Our two-factor authentication guide compares the methods.
4. Remove access on someone’s last day: disable the account, revoke sessions and devices, change any shared passwords the person knew and transfer ownership of their files.
5. Plan a register entry for every compromised account: a compromised account is not automatically a confidentiality incident, but it becomes one if personal information may have been accessed, used, communicated or lost. When in doubt, document your assessment.
6. Write down your password policy: start with the password policy generator and our small-business policy template, then have the person in charge approve it.
7. Check for exposed passwords: the breach checker shows whether a password appears in known breaches.

To review other baseline measures, work through our small-business security checklist.

5. When an account is compromised

Take a fictional example: the office manager’s mailbox at an eight-person firm starts sending phishing messages. The mailbox holds invoices and client records.

1. Regain control through the real service: set a new password, revoke sessions, and check forwarding rules and registered MFA methods.
2. Change any other passwords that were the same or similar.
3. Work out which personal information was reachable and for how long.
4. With the person in charge, assess the risk of serious injury based on sensitivity, possible consequences and the likelihood of misuse.
5. Record the incident in the register. If the risk is serious, notify the CAI and the people affected. The CAI provides an online form for businesses.
6. Fix the root cause, for example by enabling MFA on every mailbox, so the same kind of incident does not happen again.

6. Official sources

• The current text of the Act respecting the protection of personal information in the private sector on LégisQuébec, in particular sections 3.1 to 3.8 and 10.
• The CAI page on business responsibilities. In French.
• The CAI page on confidentiality incidents and security measures, which also links to the notification form and prevention guides. In French.
• The CAI’s English-language page, which links to the Act in English and to the complete business information in French.

These texts can change. Check the version in force before relying on them, and get legal advice if your situation involves sensitive information, transfers outside Quebec or an ongoing incident.