Since September 22, every business in Quebec, including a one-person business, has a person in charge of the protection of personal information. If no one has been designated, the owner holds this role by default. This is the first phase of Law 25, and additional obligations take effect next September.
Many small business owners are not yet aware of this requirement, which is understandable. However, when asked what personal information they hold, where it is stored and who has access to it, the honest answer is often uncertain, along the lines of "it is probably in my email."
This is fundamentally a documentation issue rather than a privacy law issue. The real question is whether anyone other than the owner could run the business for a week.
Why should a small business be documented so early?
Because undocumented knowledge becomes a risk at the worst possible time. When the business consists of one person, all information resides in that person's memory. This works until the owner falls ill, takes a vacation, hires an employee, brings in a partner or decides to sell. At that point, everything is affected at once.
We operated a dive centre with partners, on a small island, with staff who changed over the years. What protected the business was never sophisticated: it was a set of simple documents. An opening and closing checklist. A page explaining how the booking system worked. A list of contacts for each type of repair. The difficulties arose from information known to only one person.
Business documentation is also a significant component of the business launch program we teach at the CFP Calixa-Lavallée. Participants often view it as a task for later, once the business has grown. In our experience, it is easier at the start, when there is less to document.
How should repeated tasks be documented?
As short, step-by-step procedures. Large organizations call these standard operating procedures. The Wikipedia page on standard operating procedures presents them as formal documents, which they are in a factory or a hospital. For a small business, they can be very simple.
Select any task performed more than once a month: invoicing, posting on social media, processing an online order, closing the till or preparing a cottage for a rental guest. Then write the steps in order, in plain language, as you would explain them to a new person standing beside you.
Several recommendations apply:
- Write the procedure while performing the task, not from memory, in order to capture the steps done automatically.
- Add screenshots or photos wherever a step may be unclear.
- Date each procedure and update it whenever something changes.
- Keep each procedure short. One page is sufficient; a longer document likely covers two tasks.
No specialized software is required. A shared folder of Google Docs works well, as does a binder, and some prefer Notion. The habit matters more than the tool.
What is a decision log, and why keep one?
A dated record of decisions and their rationale. Very few businesses keep one, and in our view it is the most useful document of all.
A decision log is a running list recording the date, the decision, the reason and the people involved. For example: "Raised prices 8% because supplier costs went up twice this year." "Stopped selling at the Saturday market; sales did not justify the time." "Chose this supplier over the other because of delivery times."
Six months later, when the reason for a decision is no longer clear, the answer is recorded. When a partner disagrees, both parties can see what was agreed. When results are disappointing, the log makes it possible to distinguish a poor decision from a sound decision that did not produce the expected outcome, two very different situations.
With this year's inflation, many small businesses are adjusting prices, suppliers and hours more often than usual. This is precisely when a decision log proves its value.
Which accounts and access details should be documented?
Every account the business depends on. A situation we have encountered frequently in our web work illustrates why: a business wants to update its website, and no one knows who owns the domain name. It was registered years earlier by a nephew, a former employee or a web provider who has since moved on, in a personal account. Recovering it can take weeks.
We recommend compiling a list today of every account the business relies on:
- Domain name registrar and web hosting
- Business email
- Google Business Profile, Facebook page, Instagram
- Online store, payment processor, booking system
- Bank, accounting software, government accounts
- Suppliers with online ordering
For each account, record the name it is registered under, the email address used to log in and the location of the password. Store the passwords themselves in a reliable password manager that allows access to be shared with a trusted person, rather than in a spreadsheet titled "passwords."
Ensure that the domain and the main email account are registered in the business's name, in an account the business controls. If the current setup is unclear, we recommend reviewing your domain and email before any other item on this list.
What about personal information?
At the same time, add a page listing the personal information collected about customers and staff, where it is stored and who can access it. This is the starting point of what Law 25 requires, and it is good practice in any case. Customer lists are stored in more places than most owners realize: the email newsletter tool, the online store, a spreadsheet, a phone.
Where should business documents be stored?
In a single location, accessible to everyone who needs it, with a backup stored elsewhere.
For most businesses, a shared drive in the business's own account is sufficient. The test we apply is simple: if the owner were suddenly unavailable tomorrow, could a partner, spouse or key employee locate the account list, the procedures and the financial figures within an hour? If not, this should be addressed first.
This work is not glamorous, and few businesses publicize their procedures folder. However, a documented business is easier to manage, easier to entrust to someone else for two weeks in July and, eventually, much easier to sell. A buyer pays for a business that operates without its owner, and documentation is how that capacity is demonstrated.