Skip to main content

Canada (English)

Quebec Law 25 and the security of personal information

Law 25 strengthened the obligations of Quebec businesses regarding personal information. Behind these obligations sit very concrete IT questions: who can access what, what gets logged, where the data is hosted and how you react to an incident.

From €1,800 per project

Law 25 in brief

The Act to modernize legislative provisions as regards the protection of personal information, known as Law 25, was adopted in 2021. It amends in particular the Act respecting the protection of personal information in the private sector, which governs how businesses operating in Quebec handle personal information. Its provisions came into force in three stages: September 22, 2022 (person in charge of protection, confidentiality incidents), September 22, 2023 (most other obligations, including privacy impact assessments) and September 22, 2024 (right to portability). The Commission d'accès à l'information du Québec (CAI) oversees it; it can impose administrative monetary penalties, in addition to penal proceedings.

The law is not an IT standard and prescribes no product. But several of its obligations cannot be met without the right technical measures, and that is where an IT provider comes in. This page presents those obligations from the point of view of your information system. It is not legal advice: for the interpretation of the law, turn to your legal adviser or to the CAI's publications.

A person in charge, policies, security measures

In a business, the person with the highest authority is by default the person in charge of the protection of personal information. That person may delegate the function in writing, in whole or in part, to another person; the title and contact details of the person in charge are published on the business's website. The person in charge receives in particular the notices that service providers must give of any breach of confidentiality obligations.

The law requires security measures that are reasonable given the sensitivity of the information, its purpose, quantity, distribution and medium. The CAI gives examples in three families:

  • administrative: up-to-date policies, staff training, access limited to people whose duties require it;

  • physical: controlled access to offices, server rooms and filing cabinets;

  • technical: strong credentials and passwords, encryption of communications and stored information, encryption of mobile devices, firewalls, logging of access, software updates and secure destruction.

In a small or medium-sized business running Windows and Microsoft 365, this translates into very concrete questions: are there still dormant administrator accounts in Active Directory? Is multi-factor authentication enforced for everyone? Are laptops encrypted and managed? Do backups exist, are they protected from the accounts they back up, and has anyone tested a restore? Is anything logged that would let you tell, after the fact, who accessed a file?

Confidentiality incidents: detect, assess, notify, record

A confidentiality incident is any unauthorized access to, use or communication of personal information, its loss or any other breach of its protection: a stolen laptop, a compromised mailbox, a spreadsheet sent to the wrong person.

When an incident occurs, the business takes reasonable measures to reduce the risk of injury and to prevent a recurrence, then assesses whether the risk of injury is serious, taking into account the sensitivity of the information, the anticipated consequences and the likelihood that it will be misused. If it is, the business promptly notifies the CAI and the people concerned. In every case, it records the incident in a register, kept for at least five years, which the CAI may request.

None of this works without technical groundwork. You cannot assess an incident you cannot see, and you cannot say which records were exposed if nothing was logged. An incident procedure, centralized logs and a clear map of where personal information lives are therefore often the first things to put in place.

Assessments, cloud services and communication outside Quebec

Since September 22, 2023, a business must carry out a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving personal information. A Microsoft 365 migration, a new line-of-business application or a move to virtual desktops can fall into that category.

The same assessment is required before personal information is communicated outside Quebec. It takes into account the sensitivity of the information, the purposes for which it will be used, the protection measures, including contractual ones, that would apply to it, and the legal framework of the State where it would be communicated. The communication may take place if the assessment shows adequate protection, and it must be covered by a written agreement. For a provider established in France like us, the legal framework concerned is the GDPR, to which we are subject.

When a service provider handles personal information on your behalf, the mandate or contract is given in writing and specifies the protection measures it must apply; your business remains responsible for that information. The assessment is yours: we provide the technical input it needs, namely where the data is, who can reach it, how it is protected and what changes with the project.

Privacy by default, profiling and portability

Three further obligations have direct technical consequences:

  • Technology products and services offered to the public must provide the highest level of confidentiality by default, without any action from the person; this rule does not cover the privacy settings of cookies.

  • Functions that allow a person to be identified, located or profiled must be disclosed to them beforehand, together with the means to activate them.

  • Since September 22, 2024, a person can ask for the computerized personal information collected from them to be communicated in a structured, commonly used technological format. Your systems need to be able to export it.

Penalties

The CAI can impose on a business administrative monetary penalties of up to 10 million dollars or 2% of its worldwide turnover for the preceding fiscal year (section 90.12). Penal fines range from 15,000 dollars to 25 million dollars or 4% of that turnover (section 91), whichever is greater in both cases, and are doubled for a repeat offence.

What an IT provider can take on

Law 25 is first a matter of governance: the person in charge of protection decides, documents and answers. We work on the technical side, remotely from France, with on-site visits in Quebec possible on quotation:

  • an Active Directory audit finds excessive privileges, dormant accounts and weak delegations, with a prioritized remediation plan;

  • an IT audit covers backups, workstations, Microsoft 365, accounts and licences, and gives you a map of where personal information sits;

  • a Microsoft 365 and Intune setup puts device compliance, BitLocker encryption and conditional access in place;

  • cybersecurity awareness training teaches your teams to recognize phishing and report incidents quickly;

  • GDPR compliance support structures records of processing, policies and the cookie banner, a documentary basis useful for what Law 25 expects.

What we do not do: we do not replace your person in charge of the protection of personal information, give legal advice, carry out your privacy impact assessments, notify the CAI on your behalf or guarantee compliance. We make sure the technical measures exist, work and are documented. To talk about it, contact us; this page is also available in French: Loi 25 et sécurité des renseignements personnels.

Frequently asked questions

Does Law 25 require specific security software?

No. It requires security measures that are reasonable given the sensitivity, purpose, quantity, distribution and medium of the information. The choice of tools is yours; what matters is that the measures exist, work and can be shown.

Is a Microsoft 365 tenant hosted outside Quebec a problem?

Not in itself, but communicating personal information outside Quebec requires a prior assessment showing adequate protection, and a written agreement. We provide the technical facts for that assessment: data location, encryption, access and logging.

How quickly must the CAI be notified of an incident?

The law requires the CAI and the people concerned to be notified promptly when the incident presents a risk of serious injury. Every incident, even one with no serious risk, is recorded in the register.

Can you handle our incident register or notify the CAI for us?

The register and any notification remain your business's responsibility. We help you set up the logging and procedure that let you detect and assess an incident, and we document the technical facts when one occurs.

Who is in charge of the protection of personal information in a small business?

By default, the person with the highest authority in the business. That person may delegate the function in writing, and the title and contact details of the person in charge are published on the business's website.

Is an IT audit enough to comply with Law 25?

No. An audit establishes the state of security and prioritizes measures; compliance also rests on your policies, consent, privacy impact assessments and organization, which are your responsibility.

Let’s talk about your project

Describe your context: you will receive a first reply, with no commitment.

Discuss your project

Sources

Services·See pricing·Discuss your project
Call
Email us