Law 25 Requirements: Privacy Policy vs Privacy Program in Canada

Yes, you can have a privacy policy and still be breaking Law 25 requirements. A policy is a page on your website. A program is what your business actually does with people's data every day. Law 25 cares about the second thing, not the first.

This trips up a lot of small businesses, especially ones that just bought an AI tool or a template pack and figured that closed the loop. It doesn't. Here's what the law actually wants, and what it costs to get there.

What's the difference between a policy and a program?

A privacy policy is a promise. It says what data you collect and why, usually in a few paragraphs near your website's footer.

A privacy program is the machinery behind that promise. It answers questions like who can see customer data, how long you keep it, what happens if a laptop gets stolen, and who's accountable when a customer asks you to delete their file.

Quebec's privacy law, known as Law 25, was built around the second idea. The policy is just the public summary of a program that's supposed to already exist. If you're still deciding where to put your first dollar of compliance effort, compliance on a budget is a reasonable place to start before reading further here.

Does this apply to my business?

If you collect personal information from people in Quebec, Law 25 applies to you. Names, emails, addresses, purchase history all count. Size doesn't exempt you. Neither does being based outside Quebec, if you serve customers there.

The federal law, PIPEDA (the Personal Information Protection and Electronic Documents Act), covers the rest of the country in a similar way, built around 10 fair information principles — things like accountability, consent, and limiting collection. The big structural difference: Quebec's regulator, the Commission d'accès à l'information (CAI), can issue fines directly. The federal Privacy Commissioner cannot. If a PIPEDA investigation finds a problem, the Commissioner has to go to Federal Court to get an enforceable order. Quebec, BC, and Alberta each have their own "substantially similar" private-sector laws, which is why a business can be covered by more than one regime depending on where its customers live.

A nine-person company in Halifax selling to clients in Montreal answers to both PIPEDA and Law 25.

One wrinkle people miss: if you use a payroll processor, a bank, or a booking platform that only handles data inside its own walled system, you're still on the hook. The law follows the data, not the software. Handing information to a vendor doesn't hand off the obligation. You can outsource the storage. You cannot outsource the responsibility — a point that comes up constantly in employee data cases where owners assume their payroll vendor is the one legally on the hook.

What does Law 25 actually require, in practice?

Strip out the legal language and it comes down to a short list of habits, most of them tied to specific sections of the law:

• Name someone responsible for privacy in your organization (s. 3.1) — it can be the owner, and it doesn't need a title
• Know what personal data you hold and where it's stored
• Get real consent before collecting or sharing that data (s. 8, s. 14), and make it easy to say no — this is the part businesses get wrong most often, covered in more detail in the consent question
• Have a plan for what happens if there's a breach (s. 3.5), including notifying the CAI and affected people when there's a real risk of serious harm
• Be able to delete or hand over someone's data if they ask (s. 27, s. 28.1)

None of this requires a lawyer on staff. It requires someone in the business owning the answer, and writing it down once. A privacy policy costs nothing to write. A privacy program costs about a day of someone's time to set up properly, and almost nothing after that.

What that day actually looks like: an hour listing every place data enters your business — website forms, invoices, email, chat tools. An hour deciding who can see what, which for nine people is usually "everyone" plus a note about who handles deletion requests. An hour writing a one-page breach plan: who calls the customer, who calls the regulator, how fast. The rest is writing it down somewhere your future self can find it. Skip a step and the gap doesn't show up until something goes wrong and you're rebuilding the answer under pressure, with a regulator's clock already running.

What does ignoring this actually cost?

Law 25 penalties run on two tracks, and the article you read five minutes ago probably only mentioned one of them. Administrative monetary penalties (s. 90.1) go up to C$10 million or 2% of worldwide turnover, whichever is higher, for things like failing to designate a privacy officer or inadequate safeguards. The penal provisions (ss. 91-93) go higher still: up to C$25 million or 4% of worldwide turnover, whichever is higher, reserved for serious offences like knowingly failing to report a breach or unlawfully communicating personal information. Full detail is on the CAI's own site.

Most small business cases don't reach that ceiling, but the number exists to make a point. This isn't a rounding-error fine.

More common, and more expensive in a quiet way, is the breach itself. A leaked customer list, a lost laptop, an email sent to the wrong list: each one triggers a notification requirement, and each notification is a moment your customers decide whether they still trust you. That cost doesn't show up on an invoice. It shows up six months later in your churn numbers. If you want to see how these failures usually start, five privacy compliance myths runs through the most common wrong assumptions.

A fair objection here: "We're nine people, nobody's coming after us." Maybe not proactively. But the regulator often shows up after a complaint, not a sweep — a former employee, an angry customer, a competitor. At that point the size of your business doesn't matter. What matters is whether you can show you had a plan before the complaint landed, not one written the week after.

Compare that to the setup cost of doing it right. A few hours naming your privacy lead, mapping what data you hold, and picking tools that don't quietly send your customer data somewhere you didn't agree to. That's the trade being made here.

Where does a Canadian AI tool fit into this?

This is where a lot of small businesses get caught without meaning to. You sign up for a US-based AI chat tool to draft emails or summarize documents. Your customer data, names, contract details, health information, whatever you pasted in, is now sitting with a provider governed by US law, not Canadian law. If your team has already adopted an AI tool without thinking this through, what changes when your team adopts AI walks through the obligations that shift the moment you do.

That's not automatically illegal. But it complicates your Law 25 obligations, because the law expects you to know where personal data goes and to explain that if asked. Part of the concern is the US CLOUD Act (2018), which lets US authorities compel US-based providers to hand over data they control, regardless of where that data is physically stored. Keeping data on Canadian servers helps, but it isn't a complete answer on its own — what matters most is which company legally controls the infrastructure and whether that company is subject to US jurisdiction. A provider incorporated and operated outside US control is a meaningfully different position than a US company that merely rents Canadian data centre space.

A Canadian AI platform makes that mapping simpler by keeping both data and corporate control closer to where your other business records already live. Augure is built this way: it's a Canadian company with no US corporate parent, storing customer data in Canada. According to Augure's own published documentation, AI inference for customer conversations and documents runs on Canadian infrastructure and with vetted EU partners under zero-data-retention terms, avoiding US-based inference providers. Payment processing and email delivery do involve some US infrastructure, and Augure documents that directly in its privacy policy rather than leaving it out. For a business trying to keep its data map simple, that's a shorter list of vendors to explain to a regulator — though it's still worth checking current certifications, such as any alignment with Canada's cyber security certification frameworks, before treating any vendor's claims as a substitute for your own diligence.

Augure starts free: 50 messages a day, five documents, no credit card. The paid tier is C$20 a month if you need more room, and it doesn't erase your Law 25 obligations. Nothing does that. It just means one fewer vendor to explain to a regulator someday. You can look at what it stores and where at augureai.ca.

What to do this week

Name one person as your privacy lead. It can be you. Write their name and role in a single sentence and keep it somewhere findable. That's the requirement under s. 3.1, not a job posting.

List where customer data actually lives. Your CRM, your inbox, your invoicing tool, any AI chat tool you've pasted client info into. Ten minutes, one spreadsheet tab.

Check your current AI and cloud tools for where data is processed and who controls the provider. If it's a US tool and you handle sensitive client information, weigh whether a Canadian AI platform like Augure makes that conversation with a regulator, or a customer, shorter and cleaner.

Where this comes from: Law 25's administrative penalties reach C$10 million or 2% of worldwide turnover (s. 90.1); its penal provisions reach C$25 million or 4% of worldwide turnover (ss. 91-93). See the CAI's guidance for current detail.