A Quebec Law 25 IT checklist covers the technology side of Quebec's private-sector privacy law: knowing where personal information lives, limiting who can access it, logging and reporting confidentiality incidents, assessing privacy risks before new systems or transfers outside Quebec, and securely deleting data you no longer need. Most of it rests on everyday IT controls.
Law 25 (formerly Bill 64) modernized Quebec's Act respecting the protection of personal information in the private sector, with its obligations phased in between September 2022 and September 2024. It applies to businesses that collect, use or hold personal information about people in Quebec, including organizations headquartered elsewhere in Canada with Quebec clients or staff.
This guide translates the law into practical IT tasks for owners and managers of small and mid-sized businesses. It is not legal advice; for interpretation, speak with a privacy lawyer. What it will give you is a clear list of the systems, settings and records your IT team or provider should have in place.
Law 25 does not prescribe specific technologies, but it expects you to protect personal information with security measures that are reasonable for its sensitivity, and to prove it.
In practice, the obligations that land on IT include:
The CAI publishes official guidance for businesses on its English-language site, and it is the regulator that receives incident reports.
Work through these in order. The first two give you the visibility everything else depends on.
Contain the incident first, assess whether it creates a risk of serious injury, then record it and notify where required.
A confidentiality incident includes unauthorized access to, use of, disclosure of or loss of personal information. That covers a ransomware attack, but also an email sent to the wrong client or a lost unencrypted laptop. A workable sequence looks like this:
If you do not yet have a documented process, our guide to building a cyber incident response plan is a good starting point that you can adapt for Law 25.
You need one before a new or overhauled system handles personal information, and before personal information is communicated outside Quebec.
For a small business, this most often comes up when you adopt a new cloud application, move to a new practice-management or CRM platform, or start using a vendor whose servers are outside the province. The assessment should be proportionate to the sensitivity of the information, the purpose of using it, and the amount and distribution of the data. Your IT provider can supply much of the technical input: where data is hosted, how it is encrypted, who can access it and how it is backed up.
Microsoft 365 already includes most of the controls Law 25 relies on; the work is in configuring them deliberately.
Microsoft's own documentation on auditing in Microsoft Purview explains what activity is recorded and how long it is kept for different licences.
PIPEDA is the federal private-sector privacy law, while Law 25 is Quebec's own law, and its requirements are generally more detailed.
Businesses that operate in Quebec and other provinces often need to think about both. Law 25 adds specific obligations such as a published privacy officer, mandatory privacy impact assessments in defined situations and portability, and it carries significant penalties: administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%. For the federal side, see our PIPEDA compliance checklist.
NetFusion Designs (NFD), a SOC 2 Type II certified managed IT provider headquartered in Kitchener-Waterloo, supports clients across Ontario, Quebec and Manitoba, with an office in Montréal. Our bilingual IT support in Montreal covers the technical side of this checklist as part of managed IT: personal-information mapping, access controls, MFA, email security, Microsoft 365 configuration, backup and disaster recovery, and incident register and notification procedures. Your legal advisers handle interpretation; we make sure the systems back it up.
It can. Law 25 applies to enterprises that collect, hold, use or communicate personal information about people in Quebec in the course of carrying on business, so an Ontario or Manitoba company with Quebec clients, employees or operations may be affected. Because applicability depends on your specific activities, confirm your situation with a privacy lawyer, then use an IT checklist to put the required controls in place.
By default, it is the person with the highest authority in the business, such as the owner or chief executive. They can delegate all or part of the role in writing to someone else, for example an operations manager. Whoever holds the role should have enough authority to act during an incident, and their title and contact details must be published on your website.
A register should describe each incident: when it happened and when it was discovered, the personal information involved, the number of people affected, the assessment of whether there was a risk of serious injury, whether the CAI and individuals were notified, and the measures taken to reduce harm. Record every incident, including minor ones that did not require notification, and keep the register up to date.
No software makes a business compliant on its own. Microsoft 365 provides useful controls such as multi-factor authentication, audit logs, retention policies and sharing restrictions, but they must be configured and maintained, and they sit alongside policies, training and processes. Law 25 compliance is a combination of governance decisions and properly configured technology.
Law 25 is easier to manage when your systems are organized, documented and monitored. If you would like help reviewing your setup against this checklist, contact the NFD team and we will walk through it with you, in English or French.
%20(1).avif){kind=logo}
%201.avif)
