Sending personal information outside Quebec: assessing cloud and SaaS providers (s. 17)

Almost every Quebec business now relies on cloud and SaaS tools: email, accounting, CRM, payroll, ticketing, file sharing. Many of those tools store data in Ontario, the United States or Europe. Under Law 25, that is allowed, but not by default. Section 17 of the private sector act sets out what you have to do first.

What section 17 says

Before communicating personal information outside Quebec, a business must conduct a privacy impact assessment (PIA) that takes into account, in particular (s. 17):

1. the sensitivity of the information;
2. the purposes for which it will be used;
3. the protection measures, including contractual ones, that would apply; and
4. the legal framework applicable in the place where the information would be communicated, including its personal information protection principles.

The information may be communicated if the assessment shows it would receive adequate protection, in particular in light of generally recognized principles of personal information protection. The communication must be the subject of a written agreement that takes into account the results of the assessment and any terms agreed to mitigate the risks identified (art. 17).

The same rule applies when you entrust a person or body outside Quebec with collecting, using, communicating or keeping personal information on your behalf. In plain terms: choosing a SaaS provider that hosts data outside Quebec triggers section 17.

Note: “outside Quebec” includes the rest of Canada

Section 17 is not limited to foreign countries. A data centre in Toronto is outside Quebec. The assessment may be lighter when the destination has a comparable privacy regime, but it still needs to be done and documented.

A practical assessment for cloud and SaaS providers

The law asks for proportionality (s. 3.3), so the depth should match the risk. For most SaaS decisions, these steps cover the ground:

1. Map what goes where

Identify the categories of personal information the tool will hold, whose information it is, and every location where it is stored or accessed, including support and backup sites and the provider’s own subcontractors.

2. Rate the sensitivity and purpose

Health, financial, biometric and children’s information call for more scrutiny than a list of business contacts.

3. Review the provider’s safeguards

Look at independent evidence where available, such as an ISO/IEC 27001 certificate or a SOC 2 Type II report, and check that its scope actually covers the service you are buying. Confirm encryption, access controls, logging, incident notification commitments and data deletion at the end of the contract.

4. Consider the destination’s legal framework

Note the privacy law that applies where the data sits and whether public authorities there could access it. You do not need a legal treatise; a reasoned summary, with sources, is usually enough for common destinations.

5. Put it in the contract

The written agreement should reflect the assessment. Typical clauses: use limited to your instructions, confidentiality, security measures, notice of incidents without delay, restrictions on subcontracting, audit or reporting rights, return and destruction of data, and notice of changes in hosting location.

6. Decide and record

Conclude whether protection is adequate, list any conditions, and have an accountable manager sign off. Keep the PIA with the contract.

Shortcuts that create risk

• Relying only on the provider’s marketing page. Hosting regions and subprocessors change; ask for the current list.
• Accepting standard terms without checking. Many SaaS terms allow broad use of “customer data” for product improvement.
• Doing one assessment per provider forever. Revisit it when the provider, location or the data you send changes significantly.
• Forgetting free tools. Browser extensions, AI assistants and file converters used by staff can send client data outside Quebec without anyone noticing.

Why this matters beyond Law 25

Federal reform points in the same direction. Bill C-36, tabled on 2026-06-15, would require a privacy impact assessment before personal information is transferred outside Canada, according to McCarthy Tétrault and Gowling WLG. The bill is still before Parliament (LEGISinfo), but a disciplined vendor assessment process built for Law 25 should adapt easily.

Accel GRC keeps your vendor PIAs, contracts and transfer register together, and KW Consulting can review high-risk providers. Learn more on our Law 25 and ISO 27001 pages, see our security review service, explore KW Consulting, or contact us.

Sources

• Act respecting the protection of personal information in the private sector (English)
• Loi sur la protection des renseignements personnels dans le secteur privé, art. 17 (French)
• LEGISinfo – Bill C-36 (45-1)
• McCarthy Tétrault – Bill C-36: What organizations need to know
• Gowling WLG – Understanding Bill C-36