Rules
Quebec Startup Acquisition Campaign: Notice and Records
A Quebec startup acquisition campaign needs a Law 25 privacy notice, consent and incident records, a named privacy officer and a French version of each page.
What to take away
- Law 25, the Quebec statute that began as Bill 64, applies to every Quebec startup acquisition campaign that collects personal information from people in the province, no matter where the company is registered.
- Two regulators matterthe Commission d'accès à l'information du Québec for privacy, and the Office québécois de la langue française for French-language commercial publications.
- A compliant disclosure names the purposes, the retention period, the rights of access and correction, and the person responsible for personal information.
- The consequence is administrativethe CAI can order collection stopped, and monetary penalties scale with worldwide turnover.
- Quebec alone requires a French version of commercial publications.
Quebec runs the strictest acquisition compliance regime in Canada, and it splits into two files that most founders treat as one. Privacy sits in the Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, the statute Law 25 modernized. Language sits in the Charter of the French Language.
Who has jurisdiction over a Quebec startup acquisition campaign
Law 25 applies to an enterprise that collects personal information while carrying on an activity in Quebec. Where the company is incorporated does not decide the question. A Halifax startup aiming a campaign at buyers in Montreal is inside the scope, and so is a foreign business with Quebec customers.
Federal privacy law still covers federally regulated sectors such as banking and air transport. For most startups the Quebec statute is the operative rule, and it is stricter on consent, breach notice and transfers outside the province. The federal PIPEDA overview sets out that baseline, which matters when you sell into several provinces.
The two regulators a campaign has to satisfy
The Commission d'accès à l'information du Québec enforces the privacy statute. The Office québécois de la langue française enforces the Charter of the French Language, as amended by Bill 96. A campaign can satisfy one and fail the other.
Two Quebec Regulators
CAI
- Consent
- Manifest, free, informed
- Privacy policy
- Clear and simple language
- Serious breach
- Notice to CAI and people
- Commercial publication
- Not applicable
- Vendor contract
- Written terms, confidentiality
OQLF
- Consent
- Not applicable
- Privacy policy
- Not applicable
- Serious breach
- Not applicable
- Commercial publication
- French version required
- Vendor contract
- Not applicable
| Item | Quebec requirement | Supervising body |
|---|---|---|
| Consent | Manifest, free, informed and given for specific purposes, separately for each purpose | CAI |
| Privacy policy | Published in clear and simple language, available when information is collected | CAI |
| Serious breach | Notice to the CAI and to affected people where serious injury is possible | CAI |
| Commercial publication | French version required, with other languages permitted alongside | OQLF |
| Vendor contract | Written terms that limit use and require confidentiality | CAI |
Which rules bind you where is a mapping exercise before it is a legal one, and real market research covers that mapping before any interview or ad goes live.
What a compliant disclosure contains
The privacy notice carries most of the weight: it states each collection purpose, the categories of information held, and the retention period or the criteria that set it.
It also lists the rights of access, correction, and portability. It names the person responsible for protecting personal information, who by default is the enterprise's highest authority. That person's title and contact information must also be published on the enterprise's website.
A campaign landing page and its notice have to carry five things:
- Each purpose for which personal information is collected.
- The categories of personal information held.
- The retention period, or the criteria that set it.
- The rights of access, correction and portability.
- The name of the person responsible for the protection of personal information.
Compliant Disclosure Checklist
- Named person responsible, with contact route
- Purposes listed separately for each collection point
- Retention period or criteria used to fix it
- Access, correction and portability rights, with route
- Version date visible on the published notice
Consent has to be documented rather than assumed, and the readiness checklists that precede a launch decision should record what is already in place before a form goes live.
Records a Quebec campaign must keep
- Consent logs showing who agreed, when, to which purpose and through which form.
- Versioned privacy notices with the date each version took effect.
- Privacy impact assessments completed before any transfer of personal information outside Quebec, for example to a US ad platform or email tool.
- A register of confidentiality incidents holding the risk assessment and the notifications sent.
- Written vendor contracts that limit use and require confidentiality.
Retention is the part that catches people out. Consent evidence should outlive the campaign, and notice versions should be kept as long as the enterprise holds information collected under them. Build the log before the automation, with permission records that can be reviewed without guesswork.
Records to Keep
- Consent logswho, when, purpose, form
- Versioned privacy notices with effective dates
- Privacy impact assessments for transfers outside Quebec
- Breach register with risk assessment and notifications
- Written vendor contracts limiting use and confidentiality
What happens if you do not comply
The CAI can order an enterprise to stop collecting or distributing personal information while a file is open. It can impose monetary penalties set as a percentage of worldwide turnover, and heavier fines again for a repeat offence. A person who suffers injury can also sue for damages.
Consequences of Non-Compliance
- CAI opens file
- Stop collection or distribution order
- Monetary penalties as percentage of worldwide turnover
- Heavier fines for repeat offence
- Affected person can sue for damages
A stop order is the risk that ends a campaign. Collection halts, paid channels keep billing, and the list you built sits unusable until the file closes.
Notifications carry the same weight as consent. A breach that risks serious injury must be reported promptly to the CAI and to the people affected, and the reasoning behind that call should be written down at the time, in the incident register. The same trail keeps attributed credit honest, because a contact's source has to stay traceable once it reaches the pipeline.
Where the rules differ by place
Alberta and British Columbia have their own private-sector privacy statutes. Ontario's health statute covers health information. The remaining provinces fall under the federal law. None of them adds a language requirement, and that gap is what breaks one English template used across the country.
Privacy Rules by Province
Quebec
- Privacy statute
- Quebec Law 25
- Language requirement
- French required
- Email consent
- CASL applies
- Regulator
- CAI and OQLF
Other Provinces
- Privacy statute
- Provincial or federal
- Language requirement
- None
- Email consent
- CASL applies
- Regulator
- Provincial or federal
Email consent is federal. Canada's Anti-Spam Legislation requires express or implied consent for commercial electronic messages and a working unsubscribe, and the CRTC enforces it. It applies alongside the Quebec rules. CASL separates express consent from implied consent, and that distinction is the one most often missed when a Quebec list is built from contacts gathered under United States rules, where sending without prior consent can be lawful.
