What the law changed
Law 25 amended Quebec's privacy framework, including the private-sector act. Changes took effect in stages in 2022, 2023 and 2024, with portability provisions becoming effective in September 2024. CAI timeline
Canadian Hosting & Privacy
Quebec Law 25 and Web Hosting
Quebec Law 25 affects how organizations assess hosting providers that handle personal information. Review data locations, contracts and security safeguards before choosing a hosting service.
View the Hosting Checklist
✓ Data location
✓ Provider agreements
✓ Privacy safeguards
Updated
Start Here
What Quebec Law 25 Means for Hosting
The legal boundary is Quebec, not simply Canada. When section 17 applies, placing personal information in Ontario or another province is still outside Quebec and requires the prescribed assessment.
What a Canadian server does not prove
A Canadian-owned web host and a server located in Canada are different facts. A hosting contract must still account for where personal information is stored, processed, backed up and accessed, including services outside Quebec. Outside-Quebec guidance
About this guide: This is general information for assessing hosting services, not legal advice or a certification of any provider. Seek qualified privacy or legal advice for sensitive information and regulated sectors.
Who It Affects
Who Should Review Their Obligations?
The private-sector act applies in the context of operating an enterprise. Its scope is not determined only by the visitor's address. CAI scope guidance
Businesses in Quebec
Review personal information collected through websites, customer forms, online orders, accounts and support systems.
Businesses operating across borders
Organizations based elsewhere should assess their activities in Quebec and the laws that apply, rather than assuming one Quebec visitor settles the question.
Nonprofits and regulated sectors
Nonprofit status is not automatically an exemption. Public bodies and health-sector information may involve separate or additional obligations.
Quebec law and PIPEDA are not interchangeable. Quebec's private-sector law is deemed substantially similar to PIPEDA. Federal law continues to apply in certain cross-border and federally regulated contexts. Federal privacy guidance
Before You Choose a Host
Six Hosting Checks to Document
A Quebec Law 25 hosting assessment examines the actual service, not just a Canadian server address. These six questions help structure the evidence to request from a provider.
This checklist supports a vendor review. It does not replace a privacy impact assessment or legal advice.
-
01
Data location and privacy impact assessments
Section 17 concerns personal information communicated or entrusted for processing outside Quebec, including elsewhere in Canada. Assess the sensitivity, purpose, safeguards and destination’s legal framework; proceed only when adequate protection is established and the required written agreement is in place. Official reference
Ask your provider: Where are the website, databases, backups, logs and support operations located? Which subcontractors are involved?
-
02
A written provider agreement
Section 18.3 addresses necessary disclosures for a mandate or service contract. Its conditions include a written arrangement covering confidentiality, limited use, retention after the contract and prompt reporting of confidentiality violations. It is not the section that creates the outside-Quebec assessment requirement. Official reference
Ask your provider: Can the provider supply terms covering access, permitted use, incident notice, deletion and your ability to verify compliance?
-
03
Incident detection and notification
Keep a register of confidentiality incidents. An incident presenting a risk of serious injury triggers notification to the CAI and affected individuals with diligence. Do not substitute a generic 72-hour deadline for the Quebec rule. Official reference
Ask your provider: Who contacts you after an incident, what information will be available, and how will evidence and logs be preserved?
-
04
Necessary collection and meaningful consent
Assess whether the information is necessary before relying on consent. Where consent is required, it must meet the applicable conditions; express consent is required for sensitive information. Legal exceptions exist, so a cookie banner or a blanket consent statement does not settle every processing activity. Official reference
Ask your provider: Which analytics, marketing scripts, forms and third-party services collect information, and can you configure them to respect the choices you offer?
-
05
Safeguards proportionate to the information
Security measures must be reasonable in light of factors such as sensitivity, purpose, quantity, distribution and storage medium. Encryption, access restrictions, multifactor authentication, patching and logs are useful controls to assess. The law does not turn ISO 27001 or a SOC report into a universal hosting prerequisite. Official reference
Ask your provider: What is encrypted, who controls the keys, who can administer the account, and which evidence supports the provider’s assurance claims?
-
06
Retention, destruction and access requests
Set retention periods and arrange destruction or legally compliant anonymization when the purposes are achieved, subject to applicable retention obligations. Include backups and replicas in the lifecycle plan; do not promise instant erasure from every historical backup without understanding the process. Official reference
Ask your provider: Can you export relevant information, set retention rules and obtain a clear deletion process when the service ends?
Section 3.3 also requires privacy impact assessments for certain projects to acquire, develop or redesign information systems or electronic service delivery involving personal information. The section 17 assessment is not the only assessment that may apply. Private-sector act
Vendor Documentation
Evidence to Request, Not a Compliance Score
Generic product features cannot establish that a hosting plan is Law 25 compliant. Request documents specific to your workload, hosting locations and agreement.
- Data-flow and location record
- Primary region, backup regions, logs, remote access and subprocessors.
- Privacy impact assessment
- The relevant project assessment and, where applicable, the outside-Quebec assessment.
- Service-provider agreement
- Purposes, access, confidentiality, incident notice, subcontracting and end-of-contract handling.
- Security and assurance evidence
- Control descriptions and the entity, service, facility, date and scope of any report or certificate.
- Incident procedure
- Named contacts, escalation channels, incident register and reporting responsibilities.
- Retention and exit plan
- Retention periods, export, restoration, deletion and backup-expiry arrangements.
01
02
03
04
05
06
No ISO or SOC status is assigned without a report identifying its scope and the applicable service. None of the providers listed here is presented as having regulatory approval.
Canadian Hosting Options
Canadian Web Hosts to Evaluate
These companies are listed as potential Canadian hosting options, not ranked or certified for Law 25 compliance. Confirm the product, hosting location and contractual terms for your own requirements.
Disclosure: HostFinder is reader-supported. We may earn an affiliate commission when you visit a provider through our links, at no extra cost to you.
Astral Internet
A Quebec-based provider included for businesses evaluating locally hosted websites and assistance with their hosting setup. Assess the actual service and its supporting infrastructure rather than relying on a company-wide compliance label.
Best for: Quebec businesses evaluating local hosting and support.
Before ordering: Request the primary and backup locations, incident contact, and any assurance report that covers the exact service and facility.
Company address: 1055 Bd du Séminaire N, Bureau 242, Saint-Jean-sur-Richelieu, QC J3A 1R7
Starting at
Visit Astral Internet
$4.90CAD/mo
WHC.ca
A Montreal-based provider included for businesses comparing Canadian hosting and bilingual support. Its directory starting price is a general hosting figure, not the price of a privacy-compliance package.
Best for: Bilingual businesses comparing Canadian web hosting options.
Before ordering: Confirm the selected hosting region, backup and CDN locations, subcontractors, and written data-handling terms.
Company address: 7250 Rue Clark Bureau 301, Montreal, QC H2R 2Y3
Starting at
Visit WHC.ca
$3.92CAD/mo
Planet Hoster
A Laval-based provider included for businesses evaluating hosting for a francophone audience. Select the intended Canadian region explicitly and review where the rest of the service handles personal information.
Best for: Francophone businesses evaluating Canadian hosting locations.
Before ordering: Document the selected region, backups, remote support access and subprocessors. An ASN does not prove that traffic always remains in Canada.
Company address: 4416 Rue Louis-B.-Mayer, Laval, QC H7P 0G1
Starting at
Visit Planet Hoster
$6.64CAD/mo
FullHost
A British Columbia-based provider included for businesses considering Canadian infrastructure outside their home province. A Canadian deployment still needs an outside-Quebec assessment when section 17 applies.
Best for: Businesses evaluating Canadian hosting across provincial boundaries.
Before ordering: Confirm the service location and agreement, then assess any processing outside Quebec rather than treating Canada as a single legal boundary.
Company address: 1095 McKenzie Ave Suite 300, Victoria, BC V8P 2L5
Starting at
Visit FullHost
$12.36CAD/mo
Pricing basis: General directory starting prices are shown, not quotes for compliance-related controls, regulated workloads or managed services. Check current prices and scope directly with each provider.
Browse the Canadian-owned web hosting directoryRegulatory Context
Understanding Law 25 Penalties
Administrative penalties and penal fines are separate legal regimes. Neither is an automatic consequence of using an out-of-province web host.
For enterprises, administrative monetary penalties can reach the greater of $10 million or 2% of worldwide turnover for the preceding fiscal year. Penal fines can reach the greater of $25 million or 4% under the applicable provisions. Each regime has different conditions. CAI sanctions guidance
Focus on applicable obligations, the information at risk and evidence supporting your decisions, not speculative penalty amounts for individual small businesses.
Common Questions
Quebec Law 25 Hosting FAQ
Straightforward answers about data residency, assessments, consent, incident notices and provider responsibilities.
01 Must personal information stay in Quebec?
Not as a blanket rule under section 17. Processing outside Quebec requires the prescribed assessment and adequate protection, with the required written agreement. Other laws, contracts or sector-specific duties may impose additional requirements. Official source
02 Does hosting in Ontario avoid the outside-Quebec assessment?
No. Ontario is outside Quebec. Do not use Canadian ownership or a Canadian server location as a substitute for assessing the processing covered by section 17. Official source
03 Is explicit consent required for every hosting-provider transfer?
That is too broad. Consent rules and statutory exceptions must be considered together. Section 18.3 can permit a necessary disclosure for a service contract without consent when its conditions are met; section 17 may still apply to processing outside Quebec. Official source
04 Is Law 25’s reporting deadline 72 hours?
The private-sector law requires notification with diligence when there is a risk of serious injury. A general 72-hour deadline should not be imported from a different privacy regime. Keep a register even for incidents that do not trigger notification. Official source
05 Who is responsible for privacy in a small business?
By default, the person exercising the highest authority is responsible. The function may be delegated in writing as permitted by the law. Publish the responsible person’s title and contact information; appointing a host does not transfer away your responsibilities. Official source
06 Does a hosting certificate make my website compliant?
No. A certificate or independent report has a defined scope. It may support your review, but does not establish that your collection practices, consent, contracts, settings and retention comply. Ask for the actual scope rather than relying on a logo or a provider score.
07 How does portability affect a hosting setup?
The portability provisions took effect on September 22, 2024. They cover certain computerized information collected from the person, with statutory limits and exceptions. Assess export capabilities rather than promising a right to every inferred record or every backup. Official source
08 Are the prices shown compliance-package prices?
No. They are the same general company-level starting figures used in HostFinder’s directory. A workload requiring particular controls, contracts, locations or support may need a different product and a separate quote.
Research Sources
Legislation and Official Guidance
The legislative text and regulator references behind this guide are listed below. Confirm current requirements and any amendments when evaluating your own hosting arrangement.
-
LegisQuebec: private-sector privacy act, P-39.1 (opens in a new tab)
Sections 3.1–3.8, 10, 14, 17, 18.3, 23 and 27 are particularly relevant.
-
CAI: scope of the private-sector law (opens in a new tab)
Application to enterprises, organizations and activities connected with Quebec. French.
-
CAI: responsibility for personal information (opens in a new tab)
Privacy-officer responsibilities and governance. French.
-
CAI: use and communication of personal information (opens in a new tab)
Processing outside Quebec and service-provider exceptions. French.
-
CAI: confidentiality incidents and security safeguards (opens in a new tab)
Incident registers, serious-injury risk and reporting obligations. French.
-
CAI: valid consent (opens in a new tab)
Necessity, consent conditions and express consent for sensitive information. French.
-
CAI: retention and destruction (opens in a new tab)
Retention schedules and the end of the information lifecycle. French.
-
CAI: portability provisions, effective September 22, 2024 (opens in a new tab)
The scope of the right to receive certain computerized information. French.
-
CAI: administrative sanctions and penal proceedings (opens in a new tab)
Separate administrative and penal regimes. French.
-
OPC: provincial laws deemed substantially similar to PIPEDA (opens in a new tab)
Explains the federal/provincial relationship and important exceptions.
-
CAI: principal changes introduced by Law 25 (opens in a new tab)
The phased changes introduced in 2022, 2023 and 2024. French.