Collection Notice Requirements

Under Quebec Law 25 section 8, a notice of collection must include the purposes and means of collection, rights of access and rectification, and the right to withdraw consent. If applicable, it must also disclose the names or categories of third parties receiving the data and the possibility of cross-border transfers.

Organizations must provide the Loi 25 notice at collection when the information is collected, and subsequently on request. It must be presented in clear and simple language regardless of the means used to collect the personal information.

The Loi 25 purposes and means of collection disclosure must be explicitly stated in clear and simple language at the point of data capture. Organizations should avoid vague terms and clearly explain exactly why the data is needed and how it is being gathered.

Quebec Law 25 allows organizations to list either the specific names of third parties or the categories of third parties to whom it is necessary to communicate the information for the stated purposes.

The Quebec Law 25 access and rectification rights notice should inform individuals that they have the legal right to request a copy of their personal information and to demand corrections if the data is inaccurate or incomplete. This is typically summarized at collection and detailed in the public privacy policy.

The right to withdraw consent Quebec Law 25 requirements mandate that individuals be informed of their ability to revoke permission for the use or communication of their data at any time. This must be communicated directly in the notice of collection Quebec.

While the core legal requirements of section 8 remain the same, organizations typically create a specific employee data collection notice to accurately reflect the unique purposes, means, and third-party disclosures involved in employment contexts compared to customer data.

To provide notice at collection for website forms Loi 25, organizations should embed short just-in-time notices or clear links to the privacy policy next to submit buttons. For cookies and apps, consent banners and initial onboarding screens should display the required section 8 disclosures.

Common audit findings include using overly complex legal jargon, failing to disclose the possibility of data being communicated outside Quebec, and omitting the right to withdraw consent from the initial collection interface.

Failing to provide the required Quebec Law 25 section 8 notice template elements can result in monetary administrative penalties under section 90.1, up to $10,000,000 CAD or 2 percent of worldwide turnover, along with potential penal sanctions for severe non-compliance.

Inconsistent “notice at collection” text across web forms, apps, and support workflows is a common gap that creates compliance risk. Tools like WatchDog Security's Policy Management can centralize approved notice templates, track versions, and record stakeholder attestations so teams publish the same required § 8 disclosures everywhere.

Auditors often ask for proof that notices exist at every collection point and that updates are governed and reviewed. Tools like WatchDog Security's Compliance Center can help organize evidence (screenshots, links, change records), map it to § 8 requirements, and highlight gaps where a notice is missing or outdated.