Privacy impact assessments under Law 25: when you need one and what goes in it

A privacy impact assessment (PIA), or évaluation des facteurs relatifs à la vie privée (EFVP), is one of the Law 25 obligations that took effect on 2023-09-22 (CAI, main changes under Law 25). It is also one of the most misunderstood. Some businesses treat it as a long legal report reserved for large projects; others skip it entirely. The law sits in between.

When a PIA is required

For private businesses in Quebec, the private sector act requires a PIA in three main situations:

• Information system projects. Any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information (s. 3.3). This covers a new CRM, a payroll platform, an e-commerce site or a customer portal.
• Communication outside Quebec. Before communicating personal information outside Quebec, including when a provider outside Quebec stores or processes it on your behalf (s. 17).
• Research without consent. Before communicating personal information without consent for study, research or statistical purposes (s. 21).

Section 3.3 also requires the person in charge of the protection of personal information to be consulted from the start of the project, and the system must be able to return computerized personal information in a structured, commonly used technological format, which supports the data portability right that took effect on 2024-09-22 (CAI).

How detailed it has to be

The law builds in proportionality. A PIA “must be proportionate to the sensitivity of the information concerned, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored” (s. 3.3, second paragraph). A small scheduling tool that stores names and phone numbers does not need the same depth as a health or financial platform. What matters is that the analysis exists, is documented and is done before the project goes live.

What goes into a PIA

The CAI publishes a guide, Réaliser une évaluation des facteurs relatifs à la vie privée, updated in May 2024 to be more practical, along with a report template (CAI announcement). Its approach follows four broad phases: analyze necessity and legal compliance, define the project and evaluate privacy risks, identify measures to avoid or reduce those risks, and write the report. In practice, a solid PIA answers these questions:

1. What is the project? Its purpose, scope, owner, timeline and the systems and suppliers involved.
2. What personal information is involved? Categories, sensitivity, volume and whose information it is (clients, employees, minors).
3. Is each element necessary? The CAI’s guidance is that when in doubt, information is considered not necessary (Blakes summary of CAI guidance). Remove fields you cannot justify.
4. How does the information flow? Collection, use, sharing, storage location, retention and destruction. A simple data flow diagram helps.
5. What is the legal basis? Consent, an exception in the act, or a contractual or legal requirement.
6. What could go wrong? Unauthorized access, over-collection, function creep, profiling, transfers outside Quebec, vendor failure.
7. What will you do about it? Specific measures (access controls, encryption, retention limits, contract clauses, privacy-by-default settings) and who owns each one.
8. What risk remains, and who accepts it? A dated sign-off by an accountable manager.

Common mistakes

• Doing it after go-live. The act ties the PIA to the project, not to the launch party. Late assessments miss the chance to change design choices cheaply.
• Treating it as a vendor questionnaire. Vendor security answers are an input, not the assessment itself.
• Forgetting updates. A major change in purpose, data or provider can call for a revised assessment.
• Not linking it to the rest of the program. PIA findings should feed your personal information inventory, retention schedule and policies.

Why it is worth doing well

A documented PIA is your evidence that privacy was considered by design. It also shortens future work: the next system using similar data can reuse much of the analysis. For businesses that also follow ISO/IEC 27001 or prepare for client security reviews, the same risk analysis supports those efforts.

Accel GRC provides guided PIA workflows aligned with the CAI’s approach, and KW Consulting can run or review assessments for complex projects. See our Law 25 page, our privacy and security program offering, Accel GRC and KW Consulting, browse our sample documents, or contact us.

Sources

• Act respecting the protection of personal information in the private sector (English)
• Loi sur la protection des renseignements personnels dans le secteur privé (French)
• CAI – Principaux changements de la Loi 25
• CAI – Guide: Réaliser une évaluation des facteurs relatifs à la vie privée
• CAI – EFVP: un guide plus convivial (2024-05-14)
• Blakes – Quebec privacy regulator releases new guidance