Quebec’s Law 25 modernized the province’s private-sector privacy rules in three phases, the last in September 2024. Most businesses have a privacy policy. Fewer meet the obligations behind it.
1. A person in charge
By default, the person with the highest authority is responsible for protecting personal information. That role can be delegated in writing, and the title and contact details must be published on your website.
2. Privacy impact assessments
An assessment is required before acquiring or developing a system that handles personal information, and before communicating personal information outside Quebec.
3. A confidentiality-incident register
Every incident must be recorded, even minor ones. Incidents that present a risk of serious injury must be reported to the Commission d’accès à l’information and to the people affected.
Accel GRC tracks all three in one place. See how, or talk to us.
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult