Start with the business activities and the website journeys
For the language side of a Bill 96 website review, start with Quebec's Charter of the French Language. Quebec's government states that it applies to businesses carrying on activities in Quebec: catalogues, advertising and websites must be available in French, and consumers have the right to be informed and served in French. For privacy, this guide addresses Quebec's private-sector privacy Act as amended by Law 25.
If your business is elsewhere in Canada or in the United States, prepare a factual brief for counsel. Describe what you sell, how you market to Quebec, who you serve and where personal information goes. Ask for a written scope decision. An office address alone is an incomplete project brief.
Then list the journeys people actually use: discovering a service, comparing products, asking a question, buying, creating an account and getting support. Assign a business owner to each journey. Use that inventory to organise translation, privacy review and testing.
Plan French content beyond the home page
Section 52 of the Charter covers catalogues, brochures, commercial directories, order forms and similar public documents, regardless of medium. It requires French versions and prohibits making another-language version available unless the French version is available on terms at least as favourable. Give your content reviewer the whole customer journey when assessing that requirement.
Build a content inventory with an English item, its French counterpart, an owner and a review status. Include campaign landing pages, downloadable material, product information, form instructions and support content. Flag anything with no French counterpart for review. A translated navigation menu can look finished while the buying journey remains unfinished.
For implementation, make the language control easy to find and test whether it preserves the visitor's place. Have a fluent reviewer check meaning, terminology and calls to action. Review text embedded in images and content supplied through external tools. Treat these as quality checks for the approved scope, rather than assuming translation software settles the legal question.
- Walk from a French campaign page to the relevant product or service and its enquiry or purchase form.
- Trigger empty fields, invalid entries, failed submissions and successful confirmations in French.
- Compare the information and choices presented in each language; flag missing material for review.
- Give future content updates an owner so the French version is included in the publishing workflow.
Keep the francization threshold separate
Enterprises employing 25 or more people in Quebec for a six-month period must register with the Office québécois de la langue française within six months after that period ends to begin francization. That registration threshold should not be used as a shortcut for deciding whether a website needs French content: the government's language guidance applies to businesses carrying on activities in Quebec.
Keep the registration question with the business owner and counsel. Give the website team a specific content and functionality scope, with unresolved questions recorded separately. A project should not quietly lose its French checkout or enquiry flow because someone confused two different requirements.
Map personal information and publish the responsible contact
Under Quebec's private-sector privacy Act, a person carrying on an enterprise is responsible for protecting personal information held. The person with the highest authority is responsible for its protection and may delegate that function in writing. The responsible person's title and contact information must appear on the enterprise's website, or be made available through another appropriate means if there is no website.
Before rewriting a privacy page, map what the site actually does. Follow a test enquiry from the form into the inbox, customer management system and any connected service. Repeat that exercise for purchases, accounts and support. Record the purpose, destination and people who can access each collection of information.
Use test information for this exercise. The working inventory below is a suggested project tool, not a prescribed legal template. Add an owner and an unresolved-question column so findings turn into decisions.
| Website feature | Record | Check in practice |
|---|---|---|
| Contact form | Fields, purpose, recipients and storage | Submit a test enquiry and follow every copy. |
| Account or checkout | Information collected and connected services | Trace registration, purchase and support records. |
| Analytics or advertising | Tools, purposes and information transmitted | Inspect behaviour before and after each visitor choice. |
| Embedded tools | Provider, configuration and data destination | Review chat, booking, maps and media individually. |
| Privacy contact | Approved title, contact details and inbox owner | Send a test request and confirm it reaches the owner. |
Translate consent decisions into clear interface behaviour
Law 25 consent rules require requests for each purpose in simple, clear terms. Written consent requests must be distinct from other information. Express consent is required before sensitive personal information is used for a purpose different from the purpose of collection. Have your privacy adviser identify the purposes and decisions relevant to each collection point.
Give designers approved wording and a behaviour specification together. For each choice, state what accepting does, what declining does and which systems receive the result. Do not leave a developer to infer those decisions from a policy document. In a contact form review, for example, distinguish the enquiry workflow from any proposed marketing use and have each assessed.
Test the implementation in both languages. Confirm that the selected choice reaches the relevant system and that the visible text matches the behaviour. Keep the approved wording, test results and configuration notes together so a later redesign has a clear reference. These records support maintenance; they are not a certification of compliance.
Review tracking and default settings as separate questions
Section 8.1 addresses collection through technology with functions that identify, locate or profile a person. It requires informing the person beforehand about that technology and the means available to activate those functions. Section 9.1 requires the highest confidentiality settings by default for technological products or services offered to the public, without the person's intervention. Its default-settings rule does not apply to browser-cookie privacy settings.
That cookie exception is specific to the default-settings rule. Keep the technology review and the consent review in the project scope. Ask your adviser to classify the tools you use and approve the intended behaviour. Avoid turning a broad label such as analytics into a decision about every tool carrying that label.
For developers, the useful deliverable is a behaviour matrix. List each tool, when it starts, what it sends, which control governs it and how a changed choice is handled. Inspect actual requests during testing. A banner screenshot shows the interface; it does not show whether an advertising script or embedded widget followed the visitor's choice.
Bring privacy assessment into the project brief
Section 3.3 requires a privacy impact assessment for projects to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. The Commission d'accès à l'information also states that an assessment is required before communicating personal information outside Quebec. The assessment is proportionate to factors including sensitivity, purpose, quantity, distribution and medium.
When planning a rebuild, migration or new integration, give the privacy reviewer a diagram of the proposed information flow before implementation decisions are fixed. Identify hosting, form delivery, account storage, customer management, support tools and other destinations. Ask providers for the details needed to complete that diagram; record unknowns explicitly.
Keep the assessment work connected to the build. If a provider, destination or data field changes, flag it for the reviewer and update the implementation brief. The practical goal is to make the site's behaviour traceable to an approved decision, including decisions that affect invisible background services.
Prepare a workable personal-information export process
Quebec’s private-sector privacy Act requires covered computerized personal information collected from a person to be supplied on request in a structured, commonly used format, unless serious practical difficulties arise. Created or inferred information is excluded from that format requirement. At the applicant’s request, the information must also be communicated to a person or body legally authorised to collect it. Have your adviser define the covered records, exceptions and request process before implementing an export.
For the technical work, identify which systems hold the relevant records and who can retrieve them. Run a rehearsal with a test account: receive the request, find the records, prepare an export and review it before delivery. Check that the file is usable and contains no other person's information. Document the steps and unresolved gaps for the person handling requests.
Use an acceptance checklist before publishing
Turn the review into a bounded task list with an owner, an expected result and evidence for each item. Keep legal approval and technical verification visible as separate responsibilities. A developer can demonstrate how a form behaves; counsel can assess whether that behaviour meets the applicable obligation.
For agency projects, include the client's content approver, privacy contact and tool owners in the handoff. Save a short test record alongside the approved scope. Retest affected journeys when forms, content or integrations change.
- Confirm the applicable requirements and record open questions with the business's adviser.
- Complete the French content inventory and review the main customer journeys end to end.
- Publish the approved privacy contact details and test the destination inbox.
- Match every collection point and connected tool to a documented purpose and owner.
- Check consent wording and actual system behaviour in each supported language.
- Review default settings, tracking functions and embedded services against the approved specification.
- Resolve assessment questions about the project and information communicated outside Quebec.
- Rehearse a personal-information export with test records and record remaining gaps.
How hehe.software can help
hehe.software is a small, independent web and app studio based in Vancouver, British Columbia, working remotely with businesses across Canada and the United States. We help implement the technical side: multilingual website interfaces, forms, integrations, fixes and maintenance. We work from an agreed scope and your approved content and privacy decisions; we do not certify compliance. Email mwe@hehe.software with your website, the journeys involved and any review findings. We can scope a fixed-price project, paid discovery, hourly work or ongoing maintenance, with pricing by quote.