Law 25: what your email and files have to do with it

Where your personal information is

Member lists, employee files, client emails, scanned forms: in most organizations, they live in email and file sharing. Knowing what is there is the starting point of almost every obligation.

What the law asks

Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector. Its obligations came into force in stages:

• Since September 2022: a person in charge of the protection of personal information, and a register of confidentiality incidents, with notice to the Commission d’accès à l’information and the people affected when an incident presents a risk of serious injury.
• Since September 2023: policies and a published privacy policy, a privacy impact assessment before acquiring or redesigning an information system, and an assessment before communicating information outside Quebec.
• Since September 2024: a person’s right to obtain their information in a structured, commonly used technological format.

Where hosting comes in

When your email and files are hosted outside Quebec, the law asks you to assess that communication: the sensitivity of the information, the purpose, the protection measures and the legal framework where it goes. Hosting in Quebec, with a provider you know, makes that assessment simpler to carry out and document.

Where to start

1. Designate the person in charge and publish their contact details.
2. List where your personal information lives: email, files, backups.
3. For each, note the hosting country and the company that runs it.
4. Open an incident register, even an empty one.

Keep in mind

This article summarizes obligations to help you see where you stand. It is not legal advice: for your specific situation, consult the Commission d’accès à l’information or a legal professional.