Law 25 and a small business website often meet in simple places: a contact form, appointment booking, analytics tool, newsletter, or client area. The goal is not to turn a small business into a legal department. It is to understand what the website collects, why it collects it, where the information is sent, and how that activity is explained to people.
This article is general information, not legal advice. Obligations can depend on the information, tools, and context of your business.
Inventory the information that moves through the site
Start with visible journeys. Which fields does the form request? Which email address or platform receives responses? Do you use booking, chat, newsletter, or audience-measurement tools? This inventory helps distinguish a useful function from a collection activity without a clear purpose.
| Site element | Question to ask | Prudent step |
|---|---|---|
| Contact form | Is every field necessary? | Remove unnecessary fields |
| Booking | Which data passes through the tool? | Review settings and provider policy |
| Newsletter | How is consent obtained? | Explain purpose and unsubscribe route |
| Analytics or advertising | Is there tracking, profiling, or location data? | Inform people clearly and review settings |
Quebec’s Commission d’accès à l’information explains that organizations must provide information about collection purposes, collection methods, access and correction rights, and the right to withdraw consent, using simple and clear terms. 1
Make the privacy policy serve clarity
Organizations collecting personal information through technological means must write and publish a privacy policy in simple and clear terms. 1 A good policy is not meant to reassure people with opaque wording. It helps them understand what is collected, why, who may access it, how to ask a question, and how practices will be updated.
The Commission also says businesses must establish personal-information governance policies and practices, then make detailed information about those policies and practices available. 1 A small business can start by designating the responsible person, documenting used tools, and defining how requests or incidents are handled.
Design proportionate forms
Every requested piece of information increases responsibility. For a general enquiry, a name, a reply method, and a short description may be enough. Do not ask for sensitive information in an open field if the process is not designed to receive and protect it.
The information collected also needs to be understood by the team. Define who can access it, how long it is kept, and how it is deleted once its use is complete. If a system-development or redesign project involves personal information, the Commission says a privacy impact assessment must be carried out in the situations covered by the rules. 1
Check with the right specialists
Compliance depends on specific facts. Before launching a new form, campaign, or integration, review practices with the person responsible for personal-information protection and, where appropriate, qualified legal counsel. Keep decisions documented instead of copying a policy from another site.
To frame forms, tools, and the journey for your next website, start with Project Fit. Our guide to a health clinic website also illustrates why a restrained journey can protect clarity as well as the information people submit.