PIPEDA and Quebec Law 25 compliance for small businesses

Who PIPEDA and Quebec Law 25 apply to

PIPEDA applies to private-sector organizations across Canada that collect, use or disclose personal information in the course of commercial activities.¹ Alberta, British Columbia and Quebec have their own private-sector laws deemed substantially similar, so in Ontario PIPEDA is the general privacy law for a business, and Ontario's own similar law covers health information only.⁵

Quebec's Act respecting the protection of personal information in the private sector, amended by the 2021 statute everyone calls Law 25, covers personal information that a person collects, holds, uses or communicates while carrying on an enterprise.⁷ PIPEDA still applies in Quebec to federally regulated businesses and to personal information that crosses provincial or national borders.⁵ A clinic in Ottawa with patients from Gatineau, or a firm in Gatineau with clients in Ontario, can therefore meet both laws at once.

Health records in Ontario follow their own Act; that work has its own page on PHIPA security. This page explains the two laws in plain words so you can plan the work. A lawyer gives the legal opinion on your situation and writes the legal wording of your policies; we do the security work and keep the records in order.

PIPEDA requirements: ten principles and the safeguards behind them

The PIPEDA requirements are ten fair information principles in Schedule 1 of the Act, and every business subject to it must follow all ten.⁵ Most of them are about what you collect and why; the safeguards principle is the one that lands on your computers and files, with accountability behind it.

The safeguards principle asks for protection against loss, theft and unauthorized access, copying, use or change, with physical, organizational and technological measures: locked cabinets, access limited to the staff who need it, passwords and encryption.³ The same principle expects the level of protection to rise with the sensitivity of the information, which is why a dental office and a hardware store end up with different measures.

• Accountability: a designated person answers for compliance.³
• Identifying purposes, consent and limiting collection: you say why you collect, ask, and collect only what you need.
• Limiting use, disclosure and retention, plus accuracy: information is used for the stated purpose, kept only as long as needed and kept correct.
• Safeguards: protection matched to sensitivity, on paper and on screen.
• Openness, individual access and challenging compliance: your practices are public, people can see their file, and they can complain.

What Quebec Law 25 adds on top of PIPEDA

Quebec Law 25 adds duties PIPEDA leaves open: by default, the person with the highest authority in the enterprise is the person in charge of the protection of personal information, and that person's title and contact information go on the website.⁷ The role can be delegated in writing, in whole or in part, and the top authority stays accountable.⁹

Law 25 compliance also means governance policies approved by the person in charge and published in plain language, a privacy impact assessment for any project to acquire, develop or overhaul an information system that handles personal information, and an assessment before personal information is communicated outside Quebec, including to a cloud provider or contractor there.⁷ The provisions came into force in stages, starting on 22 September 2022 with the person in charge and confidentiality incidents, then 22 September 2023, and the last ones in 2024.¹¹

PIPEDA breach reporting and Law 25 confidentiality incidents

PIPEDA breach reporting is required when it is reasonable to believe a breach of security safeguards creates a real risk of significant harm to a person: you report to the Privacy Commissioner, notify the people affected as soon as feasible, and keep a record of every breach, serious or minor.² The two factors are the sensitivity of the information and the probability it will be misused.⁶

Under Quebec Law 25 a confidentiality incident means unauthorized access, use or communication of personal information, or its loss.⁷ An enterprise first takes reasonable measures to reduce the risk of injury, assesses the risk with its person in charge, and, when the risk is serious, notifies the Commission and the people concerned. The written notice to the Commission lists eleven items, from the information involved to the measures taken.⁸ The Commission's own guidance gives an employee looking at files without authorization and a phishing or ransomware attack as examples.¹⁰

Both laws expect facts that most small businesses have never collected in one place: which systems hold personal information, who had access, when the problem started and how many people it touches. Our work makes those answers ready before an incident happens. When one is under way, the incident response page is where to start.

Do you need a privacy officer?

Yes, in practice: PIPEDA requires a business to designate one or more individuals accountable for compliance, often called the privacy officer, and Quebec Law 25 gives the role to the person with the highest authority unless it is delegated in writing.³⁷ A five-person firm usually names the owner or the office manager.

The role stays with your business; that is how both laws are written. What we bring is the material that person needs to do the job: a current map of where personal information lives, an incident register kept in order, a list of the safeguards in place with dates, and plain answers when the Commissioner, the Commission, an insurer or a client asks.

What we do: the security side of privacy compliance

Our part of PIPEDA and Law 25 compliance is the technical and organizational protection of personal information, from the first inventory to a tested breach response. We start with a 30-minute conversation and a scope letter that names the systems, the dates and what we may touch.

What your business has in hand afterwards

At the end you have documents your privacy officer can use the same week, written in plain language with a technical appendix for whoever runs your IT. The report belongs to you.

• A map of where personal information sits and where it travels
• A report on the safeguards in place and the gaps, with priorities
• A confidentiality incident and breach register ready to fill in, kept by your business
• A plan of fixes with owners and dates, and the record of what was closed
• A short note of points for your lawyer: policy wording, consent and contracts with providers