Law 25: what a CRM team should expect to change
Quebec's modernized private-sector privacy law raised expectations in several areas that affect a CRM: how consent is obtained and recorded, who is accountable for personal information inside the organization, how incidents are handled, when impact assessments are needed, and how data transferred outside Quebec is treated. A customer database is central to nearly all of them.
Translate each obligation into a design question. Where do we record consent, and can every automation check it? Who can export lists of contacts? How long do we keep inactive records? What happens when someone asks to see or delete their information? Have answers before building.
Consent, preferences and the right to be forgotten
Consent should be structured data, not a note. Record what the person agreed to, when, through which channel, and in what wording, and let marketing and service automations read it before acting. Preference centers let customers adjust their choices themselves, which reduces administrative work and demonstrates respect for their wishes.
- Store consent by purpose and channel, with timestamps and the source.
- Honor withdrawal immediately across all automations.
- Build a repeatable process to retrieve or erase a person's information on request.
French-language experiences
Quebec expects commerce to be available in French, and rules on the language of websites, contracts, and customer documents have tightened. In Salesforce, that means planning for French labels and help text for your own staff where required, French-language portals and emails for customers, and a customer attribute for preferred language that every template respects. Use translation tools for interface labels and keep bilingual email templates under the same governance as other content.
Test with actual French-speaking users. Machine translation of field labels may be accurate, but terminology that sounds natural to a Quebec customer or employee is better learned from them.
Experience Cloud for French and bilingual portals →Anti-spam rules for email and text messages
Canada's federal anti-spam law applies to commercial electronic messages across the country, including Quebec. It requires appropriate consent, clear sender identification, and a working unsubscribe mechanism, and it expects the sender to keep records of consent. Your Salesforce marketing and sales-email setup should capture these records and honor opt-outs everywhere, including messages sent by individual sales representatives.
Data location, vendors and security controls
Where personal information is stored and which vendors can access it are questions Law 25 makes more prominent. Salesforce offers regional hosting options, including in Canada, and your integrations and add-on tools each have their own locations. Inventory every system that touches Quebec residents' personal information, and decide with your privacy officer which controls apply, such as field encryption, event monitoring, and restricted exports.
Implementation and integration services →Decisions to settle before configuration starts
- Accountable person. Name who is responsible for personal information and give them a role in design approvals.
- Consent model. Define purposes and channels, and where the authoritative consent record lives.
- Language rules. Decide which interfaces and documents must be in French, English, or both, and how language is stored.
- Retention. Set retention periods by record type and an automated or scheduled way to enforce them.
A realistic first 90 days
- Days 1 to 30. Complete a privacy assessment with your advisors, inventory data and systems, and design roles, consent, and language handling.
- Days 31 to 60. Configure the core sales or service process with consent checks and bilingual templates, and test with French-speaking users.
- Days 61 to 90. Add portals or campaigns, rehearse access and deletion requests, and train teams on the rules.
Pitfalls in Quebec projects
- Consent in free-text fields. If you cannot report on consent, you cannot honor it. Use structured fields.
- English-first design. Retrofitting French into layouts, templates, and portals is slower and more error-prone than building bilingual from the start.
- Forgotten integrations. A tool that quietly copies contacts elsewhere undermines your controls. Include every connected system in the inventory.
- Training once. Rules are easy to forget. Short refreshers and clear guidelines keep practice consistent.
