What to record in your Law 25 confidentiality incident register (and how long to keep it)

Most Quebec businesses now know they have to report serious privacy incidents. Fewer realize that the larger obligation is quieter: every confidentiality incident has to be written down, whether or not it is ever reported. That record is the incident register, and it is often the first document the Commission d’accès à l’information (CAI) asks to see.

The legal basis

Section 3.8 of Quebec’s private sector privacy act requires any person carrying on an enterprise to keep a register of confidentiality incidents and to send a copy to the CAI on request (Act respecting the protection of personal information in the private sector, s. 3.8). The details are set out in the Regulation respecting confidentiality incidents, which applies to both public bodies and private businesses and has been in force since December 2022.

Under the act, a confidentiality incident is broadly any access, use or communication of personal information not authorized by law, the loss of personal information, or any other breach of its protection. A misdirected email, a lost laptop, an employee browsing customer files out of curiosity and a ransomware attack can all qualify.

What the register must contain

Section 7 of the regulation lists eight elements for each incident:

1. A description of the personal information involved, or, if that is not known, the reasons it cannot be described.
2. A brief description of the circumstances of the incident.
3. The date or period when the incident occurred, or an approximation.
4. The date or period when the organization became aware of it.
5. The number of people concerned, or an approximation.
6. The assessment of whether the incident presents a risk of serious injury, including the sensitivity of the information, its possible misuse, the anticipated consequences and the likelihood of harm.
7. If the incident presents a risk of serious injury, the dates the notices were sent to the CAI and to the people concerned, and whether public notices were used.
8. A brief description of the measures taken to reduce the risk of harm.

Item 6 deserves attention. The act itself tells you what to weigh: the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for harmful purposes, and it requires you to consult your person in charge of the protection of personal information (s. 3.7). Recording that reasoning, even briefly, is what lets you defend a decision not to notify.

How long to keep it

Section 8 of the regulation says the information in the register must be kept up to date and retained for a minimum of five years after the date or period when the organization became aware of the incident. A register entry is not “closed” when the incident is contained: if you learn later that more people were affected, update the entry.

Incidents you should not forget to log

Because the register covers all incidents, not only reportable ones, small events belong in it too. Common examples we see missed:

• Emails or documents sent to the wrong recipient, even if the recipient confirms deletion.
• Unauthorized internal access, such as an employee consulting a file without a work reason.
• Incidents at a service provider that holds your clients’ information.
• Lost or stolen devices, including encrypted ones (encryption may lower the risk assessment, but the event still happened).
• Paper records left in a public area or disposed of without shredding.

Practical tips for a register that holds up

• Use a structured format. One row per incident, with fields matching the eight elements above, makes it easy to send a copy when the CAI asks.
• Assign ownership. The person in charge of the protection of personal information should review each entry, since the act requires that person to be consulted on the risk assessment.
• Link to evidence. Keep incident tickets, emails and forensic notes in a controlled location and reference them from the register rather than pasting sensitive details into it.
• Write for a reader who was not there. Short, factual descriptions age better than internal shorthand.
• Review trends. The CAI’s January 2026 guidance on preventing confidentiality incidents encourages organizations to identify risks and measure whether safeguards work. Your register is a ready-made source for that review.

Why it matters

Failing to keep the register or to report an incident when required can expose a business to the CAI’s administrative monetary penalties, which can reach $10 million or 2% of worldwide turnover, whichever is greater (CAI, sanctions for businesses). Beyond penalties, a well-kept register shows that your privacy program actually operates day to day, which is what regulators, clients and auditors increasingly look for.

Where to start

If you do not have a register today, create one now and backfill any incidents you know of since the obligation took effect. If you have one, check it against the eight elements and the five-year retention rule.

Accel GRC includes a Law 25 confidentiality incident register built around these requirements. Learn more on our Law 25 page, see how it fits into a privacy and security program, explore Accel GRC, browse our sample documents, or contact us.

Sources

• Act respecting the protection of personal information in the private sector (CQLR c P-39.1)
• Regulation respecting confidentiality incidents (CQLR c A-2.1, r. 3.1)
• CAI – Sanctions for businesses
• McCarthy Tétrault – Preventing confidentiality incidents: new CAI guidance (2026-01-30)