# Law 25 in 2026: a practical compliance checklist for SMBs > The five obligations every Québec business must meet, what each one means day to day, and how to keep the evidence ready for an audit. - URL: https://nextit.tech/blog/law-25-in-2026-a-practical-compliance-checklist-for-smbs/ - Language: English - Other language: https://nextit.tech/fr/blogue/la-loi-25-en-2026-une-liste-de-controle-pratique-pour-les-pme/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # Law 25 in 2026: a practical compliance checklist for SMBs NextIT Privacy Team Oct 1, 2026 3 min read **TL;DR:** the five Law 25 obligations at a glance | Obligation | What it means for you | In NextIT | | --- | --- | --- | | Person in charge | Name one and publish their title and contact details. | Compliance | | Incident register | Log every incident; notify the CAI when there is a risk of serious injury. | Incidents | | Impact assessments | Assess the risk before a new system or a transfer outside Québec. | Privacy | | Governance policies | Publish clear rules for how you handle personal information. | Compliance | | Access and portability | Answer requests from individuals within 30 days. | Requests | Most small businesses in Québec know Law 25 exists. Fewer know what it asks of them on a normal Tuesday: who answers a privacy question, where an incident gets written down, and what an inspector will ask to see. This checklist turns the law into five jobs. Each one has an owner, a piece of evidence and a place to keep it. Do them in order and you are ready for an audit long before anyone asks for one. ## What is Law 25? Law 25 is Québec’s privacy law for the private sector. It applies to every business that holds personal information about people in Québec, whatever its size. The rules came into force in three phases between 2022 and 2024. - **Accountability:** one named person answers for how you protect personal information. - **Transparency:** you publish your policies and tell people how you use their data. - **Incident response:** you record every incident and report the serious ones. - **Individual rights:** people can see, correct and take away their information. Penalties reach $25 million or 4% of worldwide turnover. For most SMBs the bigger risk is a lost contract: large customers now ask for proof of compliance before they sign. ## A five-step Law 25 checklist ### 1\. Name your person in charge By default this is your CEO. You can delegate the role in writing to someone who has the time to do it. Publish the title and contact details on your website. Law 25 controls 72% complete Person in charge named Done Privacy incident register Done Impact assessment for new systems In progress Governance policy published To do Access and portability process In progress The Law 25 view tracks each control, its owner and its evidence. Sample data. ### 2\. Start a privacy incident register Every incident goes in the register, even a small one: a lost laptop, an email to the wrong person, an exposed file share. When an incident presents a risk of serious injury, you notify the Commission d’accès à l’information and the people affected. ### 3\. Assess the risk before you share data A privacy impact assessment is required before a new system that handles personal information, and before data leaves Québec. Score the vendor, record the decision and keep the result with the contract. **Honest take:** the register and the assessments are where most SMBs fall behind. They are easy to start and easy to forget, so give each one an owner and a review date. ### 4\. Publish your governance policies Write down how you collect, keep and destroy personal information, and who can see it. Keep the language plain and post it where people can find it. ### 5\. Get ready for access and portability requests People can ask for their information, ask you to correct it, or ask for a copy they can take elsewhere. You have 30 days to answer, so agree the steps before the first request arrives. ## Frequently asked questions ### Does Law 25 apply to a 10-person company? Yes. The law applies to every business that holds personal information about people in Québec, with no minimum size. ### Who can be the person in charge? The CEO by default. The CEO can delegate the role in writing to any employee or to an outside expert. ### How long does it take to become compliant? From a few weeks self-serve to a fully guided rollout, depending on how much help you want. Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Privacy Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Privacy Team helps Québec and Canadian SMBs meet Law 25 and PIPEDA without a dedicated compliance department, from the first checklist to the audit. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [The NIST Cybersecurity Framework 2.0, explained for small businesses Oct 27, 2026](https://nextit.tech/blog/nist-csf-2-explained-for-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Compliance 101 for SMBs: frameworks, controls and evidence in plain words Oct 15, 2026](https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada