Canadian compliance
Québec Law 25 and your website
Law 25 amended Québec's private-sector privacy Act in three stages between September 2022 and September 2024. WP Doctor™ checks a WordPress site against the parts that leave evidence on the site itself.
Not legal advice. This page is technical information about how a WordPress site handles personal information. It is not a legal opinion. For your own obligations, consult a lawyer qualified in Québec privacy law.
[WPDOCTOR_LEGAL_REVIEW_COMPLIANCE]
Who it applies to (hint: not only Québec businesses)
The Act applies to anyone who collects, holds, uses or communicates personal information in the course of carrying on an enterprise. Its text sets no employee or revenue threshold. Québec's regulator, the Commission d'accès à l'information, states that an organization located outside Québec is subject to it when it handles personal information as part of its business activities in Québec.
Whether an Ontario store that ships to Montréal, or a newsletter with Québec subscribers, is carrying on activities in Québec is a legal question. A WordPress form does not record where its submitter lives, so a site open to Québec customers should be assessed as possibly in scope.
How it goes beyond PIPEDA
Where PIPEDA states principles, Law 25 adds specific duties: a privacy officer named on the website, a privacy impact assessment for information-system projects and for transfers outside Québec, a confidentiality-incident register, advance notice of identification and profiling technology, consent requested separately for each purpose, and penalties imposed directly by the regulator.
Two of these reach WordPress quickly. A site rebuild or a new CRM integration is a project to acquire, develop or redesign an information system involving personal information, which section 3.3 ties to an impact assessment. And a form service, mailing platform or analytics tool hosted outside Québec is a communication outside Québec under section 17. Section 18.3 requires a written contract with service providers.
The privacy officer requirement
By default, the person with the highest authority in the enterprise is the person in charge of the protection of personal information. That person may delegate the function in writing, in whole or in part. The title and contact information of the person in charge must be published on the enterprise's website.
On a WordPress site this is a visible check. A privacy page with a generic address and no title does not match section 3.1. The same person answers access and rectification requests in writing within 30 days.
Privacy by default — what it means for cookies and forms
Section 9.1 requires a technological product or service that has privacy settings to offer the highest level of confidentiality by default, with no action by the person. The section expressly excludes the privacy settings of a cookie. Trackers fall under section 8.1 and the consent rules instead, and forms fall under sections 8 and 14.
Section 8.1 covers technology with functions that identify, locate or profile a person. The person must be told beforehand that it is used, and told the means offered to activate those functions. Profiling includes analysing preferences, interests or behaviour. Advertising pixels and session recorders fit that description. The finding is any such script that loads before a choice is made.
For forms, section 14 requires consent that is manifest, free, informed and specific, requested for each purpose in clear and simple terms, and presented separately from other information. One checkbox covering the privacy policy and marketing does not match that text. Section 8 requires a notice at collection stating purposes, access and rectification rights, and the right to withdraw consent.
Confidentiality incidents: register, notification, thresholds
Every confidentiality incident goes in a register, whatever its severity. Where an incident presents a risk of serious injury, the enterprise must notify the Commission d'accès à l'information and the persons concerned, with diligence. Register entries are kept for at least five years, and the Commission can request a copy at any time.
An incident is unauthorized access, use or communication of personal information, or its loss. The risk assessment weighs the sensitivity of the information, the anticipated consequences and the likelihood of harmful use. On WordPress, form entries exported to a personal mailbox, or a notification email sent to the wrong recipient, fit that definition. The register is a document the business keeps. No plugin creates it.
Automated decision-making transparency
Section 12.1 applies when personal information is used to render a decision based exclusively on automated processing. The person must be informed no later than when the decision is communicated. On request, they must be told what information was used and the reasons and principal factors, and be allowed to submit observations to a staff member who can review it.
The WordPress cases are narrow: form logic that rejects an application automatically, fraud rules that cancel a store order, lead scoring that routes a person without review. Whether a given rule is a decision under 12.1 is for counsel. The diagnostic lists the automated rules that produce an outcome for a person.
Data portability
Since September 22, 2024, a person can ask for computerized personal information collected from them in a structured, commonly used technological format, and can ask that it be sent to a person or body authorized by law to collect it. Information the enterprise created or inferred is excluded, as are cases raising serious practical difficulties.
On WordPress, the request has to be answerable per person across form-entry tables, store orders, user accounts and the mailing platform. Core's personal data export does not reach plugin tables that have not registered an exporter. A CSV export filtered by email address is the usual mechanism. Test it before a request arrives.
Penalties, and why the scaling matters
The Commission can impose an administrative monetary penalty of up to $10,000,000 or 2% of worldwide turnover for the preceding fiscal year, whichever is greater. Penal fines for an enterprise range from $15,000 to $25,000,000, or 4% of worldwide turnover if greater, and double on a subsequent offence. For a natural person the administrative maximum is $50,000.
The percentage is calculated on worldwide turnover, not Québec revenue. It exceeds the dollar ceiling only above $500 million in turnover. Below that, the dollar figure is the maximum, and it is a maximum, not a tariff.
WordPress implementation checklist
A Law 25 review of a WordPress site produces eight items of evidence, listed below. WP Doctor records each one in the compliance section of a Health Report, with the page, script or table it was found in. Whether the evidence satisfies the Act is a legal conclusion that belongs to counsel.
- The privacy officer's title and contact information are published.
- The privacy policy is published, in clear and simple language.
- Each form shows a collection notice and asks consent per purpose, with no pre-ticked box.
- Identification, location and profiling scripts stay off until activated.
- Service providers outside Québec are inventoried, with contracts.
- An incident register exists.
- Per-person export and deletion work across plugin tables and backups.
- Retention periods are written down and enforced.
Other regimes are indexed on the compliance hub.
---
Every one of these is checked in a Health Report
A paid, fixed-scope diagnosis of your WordPress site — technical, performance, security and Canadian compliance — delivered as a written report you own.
Book a Health Report Back to the compliance hub