Quebec's Law 25, in plain language.
What Quebec law asks of your business, and what our system does to help you answer for it. Written for a business owner, not for a lawyer.
It applies to every enterprise in Quebec, with no employee threshold. A three-person shop is covered just as a bank is.
- Applies to
- Every Quebec enterprise
- Employee threshold
- None
- Regulator
- Commission d'accès à l'information
- In force since
- 22 September 2022
What the law asks
Six duties that reach an ordinary small business.
Section numbers refer to the Act respecting the protection of personal information in the private sector, as amended by Law 25.
- Appoint a privacy officer s. 3.1
- By default it is the person with the highest authority in the business — usually the owner — and the role can be delegated in writing. Their title and contact details must be published on your website. It is the easiest duty to satisfy, and the most often missed.
- Write your policies s. 3.2
- How information is retained and destroyed, who does what, and how a complaint is handled. Proportionate to your size: a few pages are enough for a small business.
- Be ready for an incident ss. 3.5 to 3.8
- Unauthorized access, use or loss: where there is a risk of serious injury, you must promptly notify the Commission and the people affected. And in every case, keep a register of incidents — including the ones you judge harmless.
- Protect what you hold s. 10
- Security measures "reasonable given the sensitivity of the information". The law names no technology: it is on you to show your measures match what you hold.
- Disclose what your technology does s. 8.1
- If a tool identifies a person, locates them or profiles them, you must tell them beforehand and give them the means to turn those functions off. This is what covers website tracking, and it goes further than a cookie banner.
- Assess before sending data out of Quebec s. 17
- Before personal information leaves Quebec — to a US cloud provider, say — a privacy impact assessment is required. Hosting in Quebec or Canada spares you that.
What it means for the phone
A phone system holds more personal information than people think.
- The call itself. Name, address, date of birth, card number: that is personal information, and section 10 applies while it travels.
- Voicemail and its transcripts. Stored somewhere, for a period someone chose — or that nobody chose.
- The call log. Who called whom, when, for how long. Often readable by the whole team, without anyone having asked the question.
- Call recordings. If you keep them, people must be told, and a retention period must be decided.
- The provider. If they host in the United States, section 17 applies — to you, not to them.
What we do for you
The share of the work that belongs to your telephony.
- Calls are encrypted
- Signalling and voice, by default, at no extra cost: your security measure under section 10, for the telephony part. How, and how to verify it.
- Hosting stays in Canada
- No privacy impact assessment to produce for your phone system.
- Access is named and logged
- You can answer "who listened to that message?" and "who changed that forward?" — what an incident register needs the day you need one.
- Retention periods are set
- Voicemail, recordings, logs: we agree on how long, and the system deletes on its own afterwards.
- Incidents are reported in writing
- If something touches your telephony, you get the dated facts: what happened, when, what was affected, what was done. Enough to fill your register and decide whether to notify.
- What was delivered is written down
- The measures in place are documented in your file. The day a client, an insurer or the Commission asks, you have a dated answer rather than a memory.
What stays with you
We do not do your compliance.
A vendor who promises to be "Law 25 compliant" on your behalf is selling something that does not exist. The responsibility belongs to the business. Yours to do:
- Appoint the privacy officer and publish their title and contact details on your site.
- Write your privacy policy and make it easy to find.
- Keep the incident register, even an empty one.
- Know what information you hold, where, and for how long.
- Explain all of it to your staff — most incidents are mistakes, not attacks.
We cover the telephony share, in writing. For the rest, an adviser or a lawyer will do better than us, and we say so rather than billing for it.
And on this site
We apply to ourselves what we explain.
We measure traffic on this site with a tool we host ourselves, in Canada. It sets no cookie, keeps no IP address and follows nobody from site to site: it counts visits, not individuals. Nothing goes to Google or to an ad network, so there is nothing to make you click away in a popup.
The contact form sends your message by email and does not keep it on the server. The details are in the privacy policy.
This page is not legal advice
It summarizes, in plain terms, duties we meet at our clients' premises. The official text governs: Act respecting the protection of personal information in the private sector. The Commission d'accès à l'information du Québec publishes guidance for businesses. For a specific situation, consult a legal adviser.
Where to start?
If you do not know whether your calls are encrypted, or where your voicemail is stored, that is the right first question. One meeting answers it.
- telecom@opsnode.ca
- Phone
- 514 826-2207
- Form
- Write to us