# What non-compliance really costs a Québec SMB > Fines and damages are only part of the bill. See what non-compliance costs a small Québec business, and the five basics that cover most of the risk. - URL: https://nextit.tech/blog/what-non-compliance-really-costs/ - Language: English - Other language: https://nextit.tech/fr/blogue/ce-que-coute-vraiment-la-non-conformite/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # What non-compliance really costs a Québec SMB NextIT Privacy Team Oct 15, 2026 5 min read Many owners of small and medium-sized businesses (SMBs) in Québec treat compliance as a cost they can postpone. The bill often arrives in another form: a penalty, a lawsuit, a client who will not sign, or an incident nobody knows how to handle. This article sets out the direct and indirect costs, then the cheaper path. ## The direct costs ### Law 25 penalties Law 25 sets two kinds of penalty. Administrative monetary penalties can reach $10 million or 2% of worldwide turnover for the previous fiscal year, whichever is greater. Penal fines can reach $25 million or 4% of worldwide turnover, whichever is greater. These figures are ceilings. For example, if your company had $2 million in worldwide turnover in the previous fiscal year, 2% is $40,000. The higher figure is $10 million, so that amount is the ceiling. A ceiling is a maximum, not a forecast. The amount in a case depends on its facts, so these figures show the scale of the risk, not what a specific company will pay. ### Lawsuits and damages People can sue for damages under Law 25. A court can add punitive damages when a breach is intentional or grossly negligent. A lawsuit also takes time away from your team. ### PIPEDA PIPEDA, the federal privacy law for private businesses, applies to commercial activity across Canada, including in provinces without a substantially similar law. A breach of security safeguards that creates a real risk of significant harm must be reported to the Office of the Privacy Commissioner of Canada and to the people affected. Every breach must be recorded, and the record must be kept for 24 months. ### GDPR If you offer goods or services to people in the EU, or monitor their behaviour, the EU General Data Protection Regulation (GDPR) applies to you. Its fines can reach €20 million or 4% of worldwide annual turnover. ## The indirect costs - **Lost deals.** Clients may ask for a SOC 2 report, an independent report on your controls, or an ISO/IEC 27001 certificate before they sign. Without proof, the sale can stall. - **Slow incident response.** Without a register and a named owner, your team spends the first hours deciding who acts and what to record. Law 25 requires prompt notice when an incident presents a risk of serious injury. - **Lost trust.** Clients, staff and partners ask how you protect their information. A weak answer is hard to undo, and a good answer is easier to give when the evidence is already on file. - **Your own time.** Each request, incident or client question pulls people away from their work. - **Insurance questions.** An insurer may ask about your security practices when you renew a policy. ## What one incident can look like Picture a laptop that holds customer files, stolen from a car. The owner calls the IT contractor. Then the questions start: Was the disk encrypted? Which customers are in the file? Who decides whether to notify the Commission d’accès à l’information (CAI), and who writes the record? In a business with no register and no named owner, these questions get answered in a hurry, and often from memory. With the five basics in place, the same incident follows a known path. The laptop goes into the incident register. The named person in charge decides, with the record in hand, whether the incident presents a risk of serious injury. If it does, the notice goes to the CAI and to the people concerned. Write the record on the day you learn of the incident, while the facts are fresh. A record written weeks later is harder to defend. ## The five basics that cover most of the risk You do not need a large program to start. These five basics cover most of the risk for a small business: 1. **A responsible person.** Name the person in charge of personal information. By default this is the highest authority, and the role can be delegated in writing. Publish the title and contact details on your website. 2. **An inventory of personal information.** List what you collect, why you keep it, where it is kept and who can see it. Record this list in your ROPA register, your record of processing activities. 3. **An incident register.** Record every confidentiality incident, even a small one. Decide whether it presents a risk of serious injury. If it does, notify the Commission d’accès à l’information (CAI) and the people concerned promptly. 4. **Vendor agreements.** Sign a data processing agreement (DPA) with each vendor that handles personal information for you. Keep them in one list, and check them when a contract renews. 5. **A way to answer requests.** Agree the steps for access, correction and portability requests before the first one arrives. You have 30 days to answer in writing. Write a short template for each reply, so that the team does not start from a blank page. Each basic starts with a decision and a written record. You can improve each one later, as the business grows. Start with the first two. The person in charge and the incident register give the rest of the work an owner and a place to record. ## Common mistakes - Waiting for a client to ask for proof before you start. - Writing a policy that nobody follows. - Publishing a privacy policy that does not match what you do. - Believing an empty incident register proves that nothing happened. - Buying a tool before you decide who owns the process. - Answering the first access request without written steps. - Treating compliance as a project with an end date. **Good to know:** This article is general information, not legal advice. For your own obligations, ask a qualified lawyer. ## How NextIT helps NextIT brings these basics into one platform for small and medium businesses in Québec and Canada. The compliance assessment helps you see where you stand, and the Compliance Report is available as PDF and CSV. The Security Incident Register records each incident, and Portability Requests takes requests through a public request link. Privacy & Compliance holds your impact assessments, DPA tracking and ROPA register. Start with the [compliance assessment guide](https://nextit.tech/docs/compliance-assessment/), or [book a demo](https://nextit.tech/book-a-demo/) to see it with your own company. Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Privacy Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Privacy Team helps Québec and Canadian SMBs meet Law 25 and PIPEDA without a dedicated compliance department, from the first checklist to the audit. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [The NIST Cybersecurity Framework 2.0, explained for small businesses Oct 27, 2026](https://nextit.tech/blog/nist-csf-2-explained-for-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Compliance 101 for SMBs: frameworks, controls and evidence in plain words Oct 15, 2026](https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada