Québec · Loi sur la protection des renseignements personnels dans le secteur privé

Run Law 25 — the most demanding private-sector privacy regime in Canada

For organizations operating in Québec, AccessPoint manages 30-day access and correction, the mandatory privacy impact assessments (EFVP), confidentiality incidents reported to the CAI and to affected individuals, data portability, and automated decision-making — inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

Québec — Secteur privé (Loi 25) at a glance

Response deadline
30 days for access, correction, portability, and de-indexing requests
EFVP
Mandatory for qualifying system projects and for communications outside Québec
Incidents
A register for every incident; CAI and individual notice where there is a risk of serious injury
Portability
Computerized personal information supplied in a structured, commonly used technological format
Automated decisions
Notice at the time of the decision, with a right to make observations
Languages
Français, English

Built for Québec — Secteur privé (Loi 25)

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

EFVP as a real assessment

Law 25 made the privacy impact assessment mandatory rather than advisable. Run the EFVP as a proper case — questionnaire, sections assigned to the people who can answer them, risks with owners and mitigations, and a dated, versioned sign-off.

Confidentiality incidents and the register

Every incident goes in the register, whatever its severity. Where there is a risk of serious injury, work the notification to the CAI and to affected individuals on a live checklist with the assessment recorded.

Access, correction, and de-indexing

Run every individual right on the 30-day clock — access, correction, and the de-indexing and cessation-of-dissemination right Law 25 introduced — with the grounds for any refusal cited.

Portability

Produce computerized personal information in a structured, commonly used technological format when portability is requested, tracked on the same clock as every other right.

Automated decision-making

Record where a decision is based exclusively on automated processing, the notice given, and the individual's observations — the transparency duty Law 25 imposes.

In your own tenant

Personal information stays inside your own Microsoft 365 and Azure tenant — which also makes the assessment of communications outside Québec a much shorter conversation.

Why Law 25 is different

Québec did not amend its privacy law. It rebuilt it — and attached penalties that make the difference real.

Law 25 phased in obligations that most Canadian organizations have never had to operate: a mandatory privacy impact assessment before qualifying system projects, an assessment before communicating personal information outside Québec, a confidentiality-incident register covering every incident regardless of severity, data portability, transparency about decisions made by automated processing, and a designated person responsible for the protection of personal information. Behind them sits an enforcement regime with administrative monetary penalties and sanctions well beyond what other Canadian privacy laws carry. The practical effect is that Québec compliance cannot be run out of a mailbox and a spreadsheet — it needs a register, a clock, and an assessment trail that a CAI inquiry can read.

EFVP obligatoire A dated assessment that precedes the project, as required.
Every incident registered The register covers all incidents, not just reportable ones.
Penalties that bite The strongest enforcement powers of any Canadian privacy regulator.

Configured out of the box

Installing the ca-qc-prive jurisdiction pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • P-39.1 as modernized by Law 25 as the legal-authority spine
  • The 30-day clock for access, correction, portability, and de-indexing requests
  • The mandatory EFVP questionnaire for qualifying system projects and communications outside Québec
  • The confidentiality-incident register, covering every incident regardless of severity
  • Risk-of-serious-injury assessment driving CAI and individual notification
  • Data portability in a structured, commonly used technological format
  • Automated decision-making notices and the individual's right to make observations
  • Bilingual (French-first) correspondence templates carrying the statutory wording

Québec — Secteur privé (Loi 25) Questions

Who does Québec's private-sector law apply to?
Organizations that collect, hold, use, or communicate personal information in the course of carrying on an enterprise in Québec. Because Québec's regime has been deemed substantially similar to PIPEDA, it displaces the federal law for intra-provincial activity — so a Québec enterprise works to P-39.1 and answers to the CAI.

When is an EFVP mandatory?
Law 25 requires a privacy impact assessment for any project to acquire, develop, or overhaul an information system or electronic service delivery involving personal information, and before communicating personal information outside Québec. AccessPoint runs the EFVP as a full assessment case — dated, versioned, and signed off — so the assessment demonstrably precedes the project.

Do we have to record incidents that aren't reportable?
Yes. Law 25 requires a register of confidentiality incidents covering every incident, not only those that trigger notification. Notification to the CAI and to affected individuals is separately required where the incident presents a risk of serious injury. AccessPoint registers all incidents and runs the risk assessment that decides notification, recording the reasoning either way.

Is the platform available in French?
Yes. AccessPoint's interface ships natively in French, and this pack is French-first — statutory wording, correspondence templates, and vocabulary in French, with English available for organizations that operate in both.

Run Law 25 in Your Own Tenant

Try AccessPoint free for 30 days, configured for Québec's private-sector regime. No credit card required.

Start Free Trial