Law 25 and small businesses: 5 common mistakes that can be costly

Adding a cookie consent banner to your business website is only one part of privacy management. Law 25 also involves accountability, documentation and the way personal information is handled in everyday operations.

Here are five areas to review with your privacy and IT advisers.

1. A consent checkbox without a record

An “I accept” button is a start. You also need to be able to document when consent was given and what the person agreed to. A central record helps your team manage and demonstrate those choices.

2. Forms without adequate safeguards

Review the security, access controls and data-handling practices of the platforms used to collect personal information. Assess hosting arrangements and any transfers outside Quebec as part of your privacy review.

3. No clearly identified privacy officer

Make sure responsibility for protecting personal information is clearly assigned and that the appropriate contact information is available on your website.

4. Keeping data indefinitely

Old résumés, client records and unused mailing lists should not simply accumulate. Establish retention periods and a process for securely disposing of information when it is no longer needed, subject to applicable obligations.

5. No privacy incident register

An email accidentally sent to the wrong recipient can expose personal information. Keep a register to document incidents, assess their impact and record the actions taken.

---

Unsure about your compliance? Our IT team can help assess your data lifecycle and technical safeguards. Request a free IT assessment.