You connected your website’s contact form to a Zapier flow, synced your CRM with your invoicing tool, or routed customer emails through an automation that drafts the replies. The workflow has been running for weeks. Nobody re-read Law 25 before flipping it on, and nothing broke. Now you’re wondering what that actually means for your obligations.
It changes a lot, and it changes nothing, at the same time. The law doesn’t treat an automated action differently from a manual one. A piece of personal information leaving your CRM for a tool hosted elsewhere is a communication, whether that’s a Zapier webhook firing at 3 a.m. or an employee sending the same email by hand. What automation changes is volume and frequency. Something a person used to do once a week, weighing each send, now happens hundreds of times a day without anyone thinking about it. The law carries no threshold for inattention. It applies to the hundredth communication exactly as it applied to the first.
This guide answers the question the templates sold online never ask: what does Law 25 require of a system that runs itself, not a document signed once?
This is not legal advice. Telos Machina builds automation systems, not compliance files. What this guide does: show exactly where the law touches what you’ve built, with the specific provisions and the actions that follow. What only a privacy lawyer can do: rule on your exact situation, file a notice with Quebec’s Commission d’accès à l’information (CAI), or represent you in an investigation. The Barreau du Québec runs a referral service for that.
Law 25 carries no exemption for company size
At Telos Machina, we’re a two-person company. We carry the same baseline obligations as a two-hundred-person company: a designated privacy officer, a published privacy policy, an up-to-date incident register. None of that depends on headcount, revenue, or whether you have an in-house IT team at all.
Three dates mark the law’s staged rollout:
| Date | What took effect |
|---|---|
| September 22, 2022 | Designation of a privacy officer; creation of the confidentiality incident register |
| September 22, 2023 | Published privacy policy; consent meeting the CAI’s eight criteria; opt-in cookie banner; a privacy impact assessment (PIA) required for any new system or transfer outside Quebec |
| September 22, 2024 | Right to data portability |
Automated-decision disclosure, covered further down, belongs to the same legislative wave, in force alongside everything else. All three phases have been complete since 2024. Full compliance is required now, not at some point in the near future.
Two categories of obligation: what you already carry, what automation triggers
The first category exists no matter what you automate. It comes down to four things:
- A designated privacy officer, whose name and email are published within about two clicks of your homepage.
- A privacy policy, naming the categories of information collected, the purposes of that collection, individual rights, and a complaint process.
- A retention and destruction schedule, triggered by the end of the need that justified collecting the information, not by a fixed date on a calendar.
- An up-to-date incident register, even an empty one.
Those four hold regardless of whether you run a single automation. The second category activates the moment you configure a system, and each tool you connect asks a different question:
| What you automated | The obligation it triggers |
|---|---|
| A new CRM, even one hosted in Quebec | A PIA under Section 3.3, before go-live |
| A connector to a tool hosted outside Quebec, Ontario included | A PIA under Section 17, plus a written agreement with the recipient |
| A web form feeding an email list | Granular, distinct consent for each purpose |
| A tracking pixel or an ad tool | Opt-in banner, nothing loads before the visitor chooses |
| An AI agent that sorts, scores, or decides something about a customer | Disclosure under Section 12.1 |
Five rows, five distinct obligations. Most SMBs check off one or two without knowing the other three exist.
The privacy assessment triggers when you build the system, not just when you ship it elsewhere
Section 3.3 of the law requires a privacy impact assessment (PIA) before acquiring, developing, or overhauling an information system that handles personal information. A new CRM hosted on a server in Quebec triggers this obligation exactly the way a CRM hosted in California does. The test isn’t where the data lives. It’s the fact of building or reconfiguring the system itself.
Most SMBs skip this step because they associate the PIA with the word “transfer,” and a system hosted in Quebec transfers nothing anywhere. That’s an incomplete reading of the law. A business that swaps its accounting software for a Quebec-based tool, never sending a single record outside the province, still has to produce a PIA for that change, because it just overhauled a system that handles personal information.
Once that step is done, a second question comes up almost every time: where do the servers of the tool you just connected actually sit? Most mainstream automation platforms, Zapier, Make, n8n’s cloud version, host outside Quebec by default. The moment that’s true, a second layer of obligation kicks in: the Section 17 assessment, the written agreement, confirming the recipient offers adequate protection. Our guide on cross-border data transfers (in French) covers that mechanic in full, including the costliest assumption to correct after the fact (Ontario counts as “outside Quebec” exactly like California does) and a method for producing the assessment for an ordinary Zapier scenario without losing weeks to it.
Consent lives in the checkbox, not the paragraph
The CAI sets eight validity criteria for consent: manifest, free, informed, specific, granular, comprehensible, temporary, distinct. A pre-checked box on your contact form fails the first criterion before the visitor has read anything at all. A single checkbox covering both submitting the form and joining a newsletter fails granularity: each purpose earns its own box, checked separately.
The distinct criterion sets a particular trap for an automation. A form embedded through a connector, one that folds the consent language into the “I accept the terms of service” checkbox, doesn’t satisfy that criterion, even if the full text appears somewhere on the page. The consent request has to stand apart from any other document.
Quebec is the only jurisdiction in North America requiring opt-in, not opt-out, consent for tracking tools and advertising. No tracking tool of that kind can activate before the visitor clicks “accept.” A banner modeled on the European pattern, one that loads Google Analytics in the background while the visitor is still reading the banner, doesn’t meet that standard.
In an automation, consent gets configured the moment you connect the connector, not after. A Zapier form that automatically pushes every new contact to an email marketing list, with no separate box for that second purpose, breaks the law from the first submission, even if nobody has ever complained.
When the automation decides something about a customer, Section 12.1 applies
This is the section most compliance templates miss entirely, because it arrived with the AI automation wave rather than with forms and cookies. Section 12.1 applies whenever a decision about a person is made solely or primarily through automated processing. An agent that triages incoming requests, scores a lead’s priority, or auto-denies a refund request falls inside that scope.
Four obligations follow. Inform the person that an automated system was used. On request, explain the personal information used in the decision. On request, explain the main factors and reasoning. On request, allow a human review. That last point isn’t satisfied by a closed door with a generic support email behind it: a customer who gets an automatic denial has to be able to ask a person to look at their case again, and that possibility has to be stated somewhere, not just available to whoever pushes hard enough.
This isn’t a checkbox you bolt on afterward. It’s a conversation to have before you build the automation: what is this system actually deciding, and who answers when a customer asks why?
The incident register exists even if nothing has ever happened
A confidentiality incident, under the law, reaches far past a hack: unauthorized access, a misdirected communication, a lost record, all count. The register that logs these incidents has been mandatory since 2022, kept for five years, and producible on the CAI’s request, even if your business has never had an incident to report. Our guide on the incident register (in French) covers the full system: what the eight required fields need to contain, why a downloaded spreadsheet stays empty without a reporting channel, and how to wire that channel to what actually happens in your business rather than waiting for someone to remember.
What compliance looks like in a system that runs, not a document
Most Quebec compliance vendors sell the same document: a privacy policy template, a designation letter to sign. Call it template compliance: the document exists, but nothing in the system depends on what it says. The document doesn’t do anything on its own. The system does.
Here’s what that looks like in production. A consent banner built on Google Consent Mode v2 deploys before a single tracking tool loads, with every consent category set to “denied” by default in the code, before the page has even finished rendering. The visitor sees the banner, chooses, and that choice propagates immediately to the analytics system. A quiet “Privacy preferences” button in the footer reopens the same banner at any time, because withdrawing consent has to be exactly as easy as granting it.
This system runs today on Rideaux Nalia’s site, in French and English. It’s specified for Atelier Multidécor, where building it deliberately held something else back: a separate workstream had planned to ship a new analytics tool, and someone caught in time that the workstream would put a tracker live before the consent banner existed. The analytics rollout now waits on the banner shipping, not the other way around. That’s the kind of sequencing a template can’t enforce, because a template has no idea what code is about to go to production tomorrow.
That’s the difference between writing that you comply with Law 25 and building a system that cannot do otherwise.
Where to start this week
Five moves, ordered by how much they return for the effort they take:
- List your tools. Every connector, every CRM, every platform that receives a name, an email, or an address. Note where each one’s servers sit.
- Check your consent boxes. Nothing pre-checked, one box per purpose, a banner that blocks tracking tools by default.
- Confirm an incident register exists, even a sheet with the eight columns ready and nothing in them yet.
- Designate an officer and publish their name and email within two clicks of your homepage.
- Register with MaLoi25, a free one-on-one coaching program for Quebec SMBs under 500 employees.
None of these five moves needs a consultant billing by the hour. They need a list, an unchecked box, and a decision.
What this guide doesn’t do
This guide names the provisions, explains the triggers, and shows a real system. It doesn’t replace an assessment of your exact situation: the volume of information you handle, its sensitivity, and the real risk your business carries vary from one file to the next, and only a reading of your case can settle exactly what the law requires of you. Telos Machina’s Compliance Diagnostic starts from your actual stack of tools, not a generic template, and identifies what’s already in order and what isn’t.
FAQ
Does Law 25 apply to a three-person business?
Yes. The law applies from the first personal information collected in the course of business, with no size threshold, revenue threshold, or headcount exemption. Telos Machina itself, a two-person company, carries the same baseline obligations as a two-hundred-person company: a designated officer, a published policy, an up-to-date register.
What’s the difference between a PIA and the incident register?
A PIA happens before a system is built or a transfer takes place: it assesses a risk that hasn’t occurred yet. The incident register logs what already went wrong, after the fact. Both belong to the same compliance system, but one looks forward and the other looks back.
Does using ChatGPT or Claude in an automation change anything?
Yes, on two fronts. First, every call to a US-hosted AI API potentially communicates personal information outside Quebec under Section 17, which triggers the corresponding assessment. Second, if that call’s output decides or influences a decision about a customer, like triaging a request or denying a claim, Section 12.1 stacks on top.
Is a downloaded privacy policy template enough?
A template covers the published policy, one piece of compliance. It doesn’t cover the assessment before you connect a new tool, consent configured checkbox by checkbox in a form, or a register fed the moment an incident happens. A template freezes an intention on paper. Law 25 judges what the system actually does.
Where do I start if nothing has been done yet?
With a list of your tools and where their servers live, not with a document. That’s the single move that reveals fastest where the law already applies to you, and it costs nothing but the time to make the list.