Quebec Law 25: which business practices should you review?

Law 25 amended Quebec privacy legislation. The CAI explains governance and transparency obligations among the changes. Work from the rules applicable to your organization rather than relying on the name of a reform alone.

This article proposes a preparation method for a business. It is not an exhaustive inventory of legal obligations. Record activities, entities and unresolved questions, and obtain the legal review your circumstances require before drawing a compliance conclusion.

Principaux changements apportés par la Loi 25

Choose a specific activity: receiving a customer request, creating a supplier record or handling an application. Define where it starts and ends, then involve the people performing the steps. Naming a software product does not describe how information is used.

For each step, record information categories, purpose, participants and tools. Add what happens when a file is left pending or someone leaves the team. Preserve the distinction between an observed practice and a rule that exists only in a document.

The CAI states that governance policies and practices must address matters including retention and destruction, staff responsibilities and complaint handling. They must also be proportionate to the business’s activities.

To prepare implementation, use four columns: situation, decision, responsible person and expected record. For example, who receives an information-related request and where do they direct it? The document should support action. A generic inbox without an assigned owner leaves an operational question unresolved.

Responsabilité des entreprises

A fictional business receives a request through its form and by email. Two teams prepare a response without knowing that the other is involved. The first issue to examine is intake and assignment, before selecting a new tool.

A working sheet could propose an intake point, an assignment owner, a shared reference and a place to record the decision. Request verification and response requirements must be determined with competent participants. This illustrates a possible organization of work, not a client case or a complete legal procedure.

For each gap, record the observed fact, intended result, responsible person and dependency to resolve. Separate a practice change, a configuration change and a question requiring advice. Avoid assigning a risk level without explaining its basis.

Your first review can fit on one page: selected workflow, documents examined, three open decisions, agreed actions and expected verification evidence. The list organizes work. Completing it does not, by itself, measure the business’s compliance.