How to build a Quebec Law 25 compliance checklist for your IT team

Quebec's Law 25 (formerly Bill 64) rewrote the Act respecting the protection of personal information in the private sector in three stages between September 2022 and September 2024. Any business that collects personal information about people in Quebec is covered, whatever its size or where its servers sit. Most obligations land on legal and management, but almost every one of them depends on systems that IT runs: logs, access controls, retention jobs, backups and incident handling.

This checklist translates the main duties into IT work. It is not legal advice. The Commission d'accès à l'information (CAI), Quebec's privacy regulator, notes that its own plain-language guidance simplifies the law and that the statute prevails, so confirm interpretations with counsel.

Step 1: Confirm who the privacy officer is and publish the contact

1. By default, the person with the highest authority in the business (usually the CEO or owner) is the person in charge of the protection of personal information. That person can delegate the role, in writing, to someone else, including an employee or an outside provider.
2. Ask management for the written delegation and file it with your governance records.
3. Publish the officer's title and contact details on your website. If there is no website, they must be made available by another appropriate means. IT usually owns this change, so add it to the site's footer or privacy page and create a monitored role mailbox rather than a personal address.
4. Give the officer read access to the incident register and the privacy impact assessment (PIA) folder described below.

Step 2: Map where personal information lives

1. List every application, database, file share, SaaS tenant and backup set that holds personal information about clients, employees or prospects.
2. For each, record the categories of data, who has access, where it is hosted (inside or outside Quebec), the retention period and how it is destroyed.
3. Flag anything stored or processed outside Quebec, including other Canadian provinces and cloud regions in the United States. These transfers trigger a PIA (Step 3).
4. Flag any feature that can identify, locate or profile a person, such as tracking cookies, location services or analytics. Law 25 requires those functions to be off by default and requires you to tell people they exist and how to turn them on.

Step 3: Build privacy impact assessments into your project process

The law requires a PIA in three situations: for any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information; before communicating personal information outside Quebec; and before disclosing information without consent for study, research or statistical purposes.

1. Add a PIA gate to your change and procurement process so new SaaS tools, system migrations and major upgrades cannot go live without one.
2. Use the CAI's guide, Réaliser une évaluation des facteurs relatifs à la vie privée, as a template. The CAI says the guide is meant to help, not to be followed to the letter, and the effort should be proportional to the sensitivity, purpose, quantity, distribution and medium of the information.
3. For transfers outside Quebec, the PIA must consider the sensitivity of the information, the purpose, the protection measures (including contractual ones) and the legal framework in the destination. The transfer can go ahead only if the assessment shows the information would receive adequate protection, and it must be backed by a written agreement.
4. Involve the privacy officer from the start of the project, not at sign-off.
5. For new systems, confirm that the product can export a person's computerized personal information in a structured, commonly used technological format. The portability right took effect Sept. 22, 2024.

Step 4: Set up the confidentiality incident register

A confidentiality incident is any unauthorized access, use or communication of personal information, its loss, or any other breach in its protection. Every incident goes into the register, whether or not it must be reported. According to summaries of the Regulation respecting confidentiality incidents by Gowling WLG, each entry needs:

• a description of the personal information involved, or why it cannot be described;
• a brief description of the circumstances;
• the date or period of the incident, and the date or period you became aware of it;
• the number of people affected, or an estimate;
• your assessment of whether there is a risk of serious injury, and the factors behind it;
• where there is such a risk, the dates notices went to the CAI and to the people affected, and whether a public notice was given;
• a brief description of the steps taken to reduce the risk of injury.

1. Build the register in a system with access control and an audit trail, such as a restricted ticket queue or a locked-down list. A shared spreadsheet on an open drive is not good enough.
2. Keep each entry for at least five years after the date or period you became aware of the incident.
3. Write the trigger into your IT procedures: a misdirected email, a lost laptop, an over-shared folder and a ransomware attack all qualify.
4. The CAI can ask for a copy of the register, so keep entries factual and complete.

Step 5: Define the serious-injury assessment and notice workflow

1. When an incident occurs, take reasonable measures right away to reduce the risk of injury and prevent a repeat.
2. Assess the risk of serious injury with the privacy officer, considering the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes.
3. If the risk is serious, notify the CAI promptly using its incident notice form, and notify the affected people. The notice to the CAI includes your Quebec enterprise number, a contact person, the information involved, the circumstances, dates, the number of people affected (and how many live in Quebec), the risk factors, and the measures taken.
4. If you also operate outside Quebec, the same incident may need a separate report under federal PIPEDA rules. Plan for both from the same evidence.

Step 6: Apply retention, destruction and anonymization rules

1. When the purpose for which information was collected has been achieved, the law requires you to destroy it or anonymize it to use it for serious and legitimate purposes.
2. Anonymization has a specific meaning. Information counts as anonymized only if it is, at all times, reasonably foreseeable that it irreversibly no longer allows the person to be identified, directly or indirectly. Removing names (de-identification) is not enough; de-identified data is still personal information.
3. If you plan to anonymize, follow the Regulation respecting the anonymization of personal information, in force since May 30, 2024. It sets a process that includes defining the purpose, carrying out the work under the supervision of a person qualified in the field, removing direct identifiers, analyzing re-identification risk, and periodically re-evaluating the results. The test is that the residual risk is very low, not zero.
4. Automate retention where you can: lifecycle rules in storage, mailbox retention policies and scheduled purges, each tied to a documented retention schedule.

Step 7: Check vendor contracts and automated decisions

1. When you give a service provider personal information to perform a mandate, the agreement must be in writing and spell out the protection measures. Review hosting, payroll, CRM and managed-service contracts.
2. If a system makes decisions about people based exclusively on automated processing, the person must be told and given a way to ask for a review. List any such systems.

What is at stake

The CAI can impose administrative monetary penalties of up to $10 million or 2 per cent of worldwide turnover, and penal fines can reach $25 million or 4 per cent of worldwide turnover, whichever is greater. Re-identifying, or trying to re-identify, a person from anonymized data is itself an offence. Review this checklist at least once a year and after every significant system change.

Sources

• Commission d'accès à l'information: Réaliser une évaluation des facteurs relatifs à la vie privée (guide)
• Commission d'accès à l'information: Incidents de confidentialité (entreprises)
• Gowling WLG: The ABCs of reporting a privacy breach under Quebec's Law 25
• Miller Thomson: Government of Quebec regulation on anonymization of personal information
• Langlois: The Regulation respecting the anonymization of personal information is coming into force
• CFIB: Everything you need to know about Quebec's Law 25