Law 25 Quebec and Web Hosting: What Your Business Actually Needs to Do

Quebec's Law 25, officially Act 25 to modernize legislative provisions as regards the protection of personal information, reached full enforcement in September 2023. If your business collects personal information about Quebec residents through a website, that website's hosting is now directly implicated in your legal obligations. This is not abstract compliance theory. Regulators have been actively enforcing the law since 2023.

What Law 25 actually requires from your business

You need a designated person responsible for personal information protection in your organization. This does not have to be a dedicated staff position in a small business, but there must be someone named and responsible. You need a privacy policy that is written in plain language and published on your website. You need to conduct a Privacy Impact Assessment before any new technology project that involves personal information processing. This includes adopting new software, launching new data collection features, and changing hosting providers. And you need breach notification: if a privacy incident occurs that presents a risk of serious injury to the people whose data was involved, you must notify both the Commission d'accès à l'information du Québec and the affected individuals.

The hosting-specific obligation: communicating information outside Quebec

The part of Law 25 most relevant to hosting decisions is the obligation around communicating personal information outside Quebec. If personal information collected from Quebec residents will be communicated to a third party outside Quebec, you must first conduct a Privacy Impact Assessment confirming that the information will receive protection equivalent to what Law 25 requires. Your hosting provider is a third party for this purpose. The server your website runs on stores personal data from your forms, your CRM integrations, your account databases, and your log files. Where that server sits matters legally.

Hosting on a server physically located in Quebec removes this obligation entirely. Hosting elsewhere in Canada simplifies it considerably, because Canadian law offers comparable protections and the assessment is straightforward. Hosting in the US on a US-owned provider introduces the most complexity, because US law, particularly the CLOUD Act, provides materially weaker privacy protections than Law 25 and PIPEDA. The assessment for a US host is harder to complete satisfactorily, and you must document it and keep it on file.

What your hosting agreement must say

When personal information is communicated to a third party, Law 25 requires a written agreement that includes specific provisions. The agreement must require the third party to protect the information. It must require them to use it only for the agreed purpose. It must require that they notify you in the event of a confidentiality incident. And it must require that the personal information be destroyed once the purpose of the communication has been fulfilled, unless retention is required by law.

Review your current hosting terms of service against these requirements. Most commodity US hosts do not include these provisions in their standard terms. Most Canadian hosts operating under Canadian privacy law are better positioned to provide hosting agreements that satisfy Law 25's third-party contract requirements. If your current host cannot provide a data processing agreement or a data processing addendum that addresses these points, that is worth noting in your compliance program.

Practical steps to reduce your hosting compliance exposure

Choose a hosting provider that is genuinely Canadian-owned with infrastructure in Canada. Request and review their data processing agreement before signing up. Confirm the physical server location in writing, not just from a marketing page. Map all the personal data flowing through your website: form submissions, account data, analytics, and log files. Understand which third parties those data flows reach and whether each requires a Law 25 compatible agreement. Run a Privacy Impact Assessment if you change hosting providers, since that qualifies as a new technology deployment involving personal information processing.

One practical point: a Law 25 Privacy Impact Assessment for a hosting provider change is not necessarily a major undertaking for a small business. It is a documented review of the personal information involved, the risks of the transfer, and the protections in place. Working with a provider that can supply documentation to support that review, including a data processing addendum and a clear answer to where your data physically resides, makes the assessment much faster to complete.

The Commission d'accès à l'information and enforcement

The Commission d'accès à l'information du Québec has been publishing enforcement decisions and has the authority to impose administrative monetary penalties. For serious or intentional violations, penalties can reach up to 25 million dollars or 4 percent of worldwide turnover, whichever is greater. The law was modelled in part on GDPR's enforcement framework. The CAI has taken a proportionate approach to enforcement so far, but the trend is toward increased scrutiny as businesses have had time to comply. Ignorance of the requirements is not a defense, and "we were using the same US host we always used" is not a satisfactory response to a complaint investigation.