Quebec's Law 25 for Sports Clubs: What Volunteers Need to Know

What Law 25 is, in plain language

If you volunteer for a youth sports club in Quebec, you have probably heard "Law 25" mentioned and wondered whether it is something you need to worry about. The short version: Law 25 is Quebec's modernized privacy law, which updated the rules for how organizations handle the personal information of the people they serve. It applies broadly to organizations operating in Quebec, and a sports club — which collects names, birthdates, contact details, and sometimes medical notes about children — is exactly the kind of organization that holds personal information worth protecting.

You do not need to become a privacy expert to be a responsible volunteer. The law is built on a handful of common-sense ideas, and most of what it asks is what a thoughtful registrar would already want to do: be clear about what you collect and why, collect only what you genuinely need, keep it secure, and respect the families who trust you with their data. The sections below walk through the core ideas you are most likely to meet, in everyday terms.

This is general information, not legal advice. Every club's situation is different, and if you have specific questions about your obligations you should consult a qualified professional. Quebec also has a privacy regulator — the Commission d'accès à l'information du Québec — that oversees privacy law in the province and publishes guidance for organizations.

The core ideas you will meet

Consent. Families should understand what information you are collecting and why, and they should agree to it. In practice that means being upfront on your registration form — saying plainly what you ask for and how it will be used — rather than burying it or collecting things without explanation.

Collect only what you need. A common pitfall is gathering more than the club actually uses "just in case." The discipline Law 25 encourages is to ask only for information that serves a clear purpose. If you cannot say why you need a field, that is a sign to drop it.

Let families access and correct their information. People have a reasonable expectation that they can see the information an organization holds about them and fix it if it is wrong. For a club, that means being willing and able to show a family their own data and update it when they ask.

Breach awareness. If personal information is lost or exposed in a way that could cause harm, that is a serious event, and the law sets expectations for how organizations respond. You do not need to memorize the procedure, but you should know that a data breach is something to take seriously and escalate, not quietly hope nobody notices.

Know where your data is hosted. It matters where the personal information your club collects actually lives, and how it travels. Knowing that your software keeps families' data in Canada, and understanding who can access it, is part of being able to answer a parent who asks, "where does my child's information go?"

How a club builds a good posture

Building a good privacy posture is less about paperwork and more about habits. Start by looking at your registration form with fresh eyes and cutting any field you cannot justify — every piece of information you do not collect is one you never have to protect. Be plain with families about what you ask for and why, so consent is informed rather than assumed.

Then think about access: not everyone in the club needs to see everything. Medical notes, in particular, should be visible only to the people who genuinely need them. Keep your records where you can find them, be ready to show a family their own information when they ask, and have a simple plan for what you would do if something went wrong — who you would tell, and how you would respond. None of this requires a lawyer on staff; it requires a club that treats families' data the way it would want its own treated.

A reminder, because it bears repeating: this is general information, not legal advice. Use it to ask better questions, and bring the specifics of your club's situation to a qualified professional and the guidance the Commission d'accès à l'information publishes.

How software designed around Law 25 supports you

Good software cannot make your club compliant on its own — compliance depends on how your people actually operate — but the right tool can make a good posture much easier to maintain. Software designed around Law 25 builds the sensible defaults in, so your volunteers fall into good habits rather than having to invent them.

What that looks like in practice: data hosted in Canada, so families' information stays where they expect it; access scoped tightly, so medical notes and contact details are seen only by the people who need them; and a French-first family experience, so the consent and confirmation a Quebec parent reads are clear in their own language. SideKrew is designed around Law 25 in exactly this sense — built with these privacy expectations in mind. Note the careful wording: designed around, not "certified" or "compliant." No honest vendor should hand you a certificate for obligations that are ultimately your club's; what good software does is support the posture you build, not replace it.

If you run a Quebec club, the practical path is to pair a good internal habit — collect less, be clear, control access — with a tool that makes those habits the default. From there, the same software can also take the administrative grind off your volunteers, so privacy and ease of use pull in the same direction rather than against each other.