Data Retention Policy — Quebec
Province de Québec — Loi sur la protection des renseignements personnels (RLRQ, c. P-39.1) | Loi 25 | Loi sur l'administration fiscale (RLRQ, c. A-6.002)
DATA RETENTION POLICY / POLITIQUE DE CONSERVATION ET DE DESTRUCTION DES DONNÉES
**Organization / Organisation :** [Organization Name]
**Address / Adresse :** [Organization Address]
**Privacy Officer / Responsable de la protection des renseignements personnels :** [Privacy Officer Name]
**Effective date / Date d'entrée en vigueur :** [Effective Date]
**Next review / Prochaine révision :** [Review Date]
**PURPOSE AND LEGAL BASIS.** This Data Retention Policy establishes the retention schedules and destruction procedures for personal information and business records held by [Organization Name]. This Policy is required under the Act respecting the protection of personal information in the private sector (Loi sur la protection des renseignements personnels dans le secteur privé, RLRQ, c. P-39.1) as amended by Law 25 (Loi 25), and complements the organization's tax record-keeping obligations under the Tax Administration Act (Loi sur l'administration fiscale, RLRQ, c. A-6.002).
**RETENTION SCHEDULE.** The following retention periods apply to each category of data: (a) Customer personal data: [Customer Data Retention]. (b) Employee records: [Employee Data Retention]. (c) Financial records and tax documents: [Financial Records Retention]. (d) Website / application user data: [Website Data Retention]. Retention periods begin from the trigger event specified for each category (last transaction, end of employment, or end of fiscal year).
**DESTRUCTION PROCEDURES.** Upon expiry of the applicable retention period, personal information must be destroyed or anonymized as follows: [Destruction Method]. Destruction must be documented in a destruction log maintained by the Privacy Officer. Anonymization must be irreversible — the organization must verify that the anonymized data cannot be re-identified by any reasonably foreseeable means.
**GOVERNANCE AND COMPLIANCE.** The Privacy Officer ([Privacy Officer Name]) is responsible for implementing and monitoring compliance with this Policy. Employee training frequency: [Training Frequency]. Any data breach affecting personal information must be reported to the Commission d'accès à l'information (CAI) and affected individuals as required by Law 25. This Policy is reviewed at least annually and updated to reflect changes in applicable law and organizational practices.
APPROVED BY / APPROUVÉE PAR :
Name / Nom : ____________________
Title / Titre : ____________________
Signature: ____________________ Date: ____________________
**Privacy Officer / Responsable :** [Privacy Officer Name]
Signature: ____________________ Date: [Effective Date]
Authorized Officer / Dirigeant autorisé
________________
Signature
Date: ________________
Privacy Officer / Responsable de la protection des renseignements personnels
________________
Signature
Date: ________________
What Is a Data Retention Policy — Quebec?
A Data Retention Policy is a formal legal document used in Quebec for business operations, corporate governance, and commercial transactions. Quebec data retention policy required under Act respecting the protection of personal information in the private sector (RLRQ c P-39.1) as amended by Law 25 and tax record-keeping obligations under the Tax Administration Act. Covers retention schedules, destruction, data security, and CAI compliance. This document operates within Quebec's civil law (Civil Code of Quebec) framework and is designed to provide clear legal protection and certainty for all parties involved. These laws establish the legal requirements for valid agreements, the rights and obligations of the parties, and the remedies available in case of breach or dispute. Understanding the applicable legal framework is essential for drafting an effective Data Retention Policy that will be enforceable under Quebec law. The importance of having a properly drafted Data Retention Policy cannot be overstated. Without a clear, written agreement, parties risk misunderstandings, disputes, and potential legal liability. A well-drafted Data Retention Policy sets out the terms and conditions that govern the relationship between the parties, including their respective rights, obligations, and the procedures for resolving any disagreements that may arise. It serves as the primary reference point should any questions or disputes occur during the course of the arrangement. In today's regulatory environment in Quebec, compliance with legal requirements is increasingly important. A Data Retention Policy helps confirm that all parties are meeting their legal obligations and provides a clear record of the agreed terms for future reference. Using a standardized Data Retention Policy template offers several practical advantages. It confirms that all essential clauses are included, reduces the time and cost of drafting from scratch, and provides a professional framework that can be customized to suit specific needs. Whether you are an individual, a small business owner, or a large corporation operating in Quebec, having access to a well-structured template confirms consistency and completeness in your legal documentation.
When Do You Need a Data Retention Policy — Quebec?
A Data Retention Policy is needed whenever parties in Quebec wish to formalize their arrangement regarding business operations, corporate governance, and commercial transactions. There are numerous situations in which this document becomes essential for protecting the interests of all involved parties. In a business context, you may need a Data Retention Policy when entering into new commercial relationships, when formalizing existing arrangements that have previously been informal, when expanding your business operations, or when restructuring existing agreements. Companies registered with REQ should confirm proper documentation is maintained for all significant business transactions. You should also consider using a Data Retention Policy when there has been a change in circumstances that affects an existing arrangement, when you need to comply with new regulatory requirements, when you wish to update outdated documentation, or when professional advisors recommend formalizing certain aspects of your affairs. In Quebec, maintaining current and accurate legal documentation is considered best practice and can help prevent costly disputes. It is generally advisable to prepare a Data Retention Policy before any issues arise, rather than trying to document terms after a dispute has already begun. Proactive documentation provides clarity and reduces the potential for misunderstandings. If you are unsure whether you need this document for your specific situation in Quebec, consulting with a qualified legal professional can provide guidance tailored to your circumstances. The timing of executing a Data Retention Policy is also important. In Quebec, certain documents must be executed before specific actions are taken or within prescribed time periods to be effective. Delaying the preparation of necessary legal documents can result in complications, lost rights, or additional costs. Therefore, it is recommended to prepare this document as early as possible once the need has been identified.
What to Include in Your Data Retention Policy — Quebec
A well-drafted Data Retention Policy for use in Quebec should contain several essential elements to confirm it is legally effective and provides adequate protection for all parties. Party Identification: The document should clearly identify all parties involved, including their full legal names, addresses, and relevant identification numbers. For individuals in Quebec, this may include identity card or passport numbers. For companies, registration numbers and registered addresses should be specified. Clear identification prevents disputes about who is bound by the agreement. Recitals and Background: The document should include background information explaining the context and purpose of the arrangement. This helps establish the parties' intentions and can be important in interpreting the terms of the document if any ambiguity arises later. The recitals section provides valuable context for the operative provisions that follow. Operative Terms: The core terms and conditions should be set out clearly and thoroughly. This includes the rights and obligations of each party, any conditions or prerequisites, the duration of the arrangement, and any limitations or restrictions. All key terms should be defined precisely to avoid ambiguity and potential disputes. Payment and Financial Terms: Where applicable, the document should specify any payments, fees, deposits, or other financial considerations. The amounts, currency (CAD), payment schedules, and methods of payment should be clearly stated. Any provisions for late payment, interest charges, or adjustments should also be included. Term and Termination: The document should specify its duration, including the start date, end date or conditions for expiry, and any provisions for renewal or extension. The circumstances under which either party may terminate the arrangement early should be clearly defined, along with any notice requirements and the consequences of termination. Dispute Resolution: The document should include provisions for resolving any disputes that may arise, such as negotiation, mediation, arbitration, or litigation. In Quebec, parties may choose to specify the jurisdiction of Quebec courts and the applicable law. Including a clear dispute resolution mechanism can save significant time and expense if disagreements occur. Governing Law and Jurisdiction: The document should specify that it is governed by the laws of Quebec and that disputes shall be subject to the jurisdiction of Quebec courts. This is particularly important in cross-border transactions or where parties are based in different jurisdictions. Signatures and Execution: The document must be properly signed by all parties or their authorised representatives. In Quebec, certain documents may need to be witnessed, notarised, or executed as deeds to be legally effective. The date of execution should be clearly recorded, and each party should retain an original signed copy for their records.
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Data Retention Policy — Quebec (Quebec) [Legal document template]. Forms Legal. https://forms-legal.com/quebec/business/contracts/data-retention-policy-quebec
"Data Retention Policy — Quebec (Quebec)." Forms Legal, 2026, https://forms-legal.com/quebec/business/contracts/data-retention-policy-quebec.
@misc{formslegal-data-retention-policy-quebec,
author = {{Forms Legal}},
title = {Data Retention Policy — Quebec (Quebec)},
year = {2026},
howpublished = {\url{https://forms-legal.com/quebec/business/contracts/data-retention-policy-quebec}},
note = {Free legal document template. Based on Civil Code of Québec (CCQ), Book Five: Obligations}
}Frequently Asked Questions
Quebec's Law 25 (Loi 25), which amended the Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1), requires enterprises to only keep personal information for as long as necessary to fulfill the purpose for which it was collected. Once that purpose has been achieved, the enterprise must either destroy the information or anonymize it for archival purposes. A formal data retention policy (politique de conservation et de destruction des renseignements personnels) documents the enterprise's schedule for retaining different categories of information and the procedures for their secure destruction. This policy must be publicly available under Law 25 (as part of the enterprise's Privacy Policy). The Commission d'accès à l'information (CAI) can audit compliance with Law 25, and enterprises that fail to establish adequate retention and destruction policies face administrative penalties of up to $10 million or 2% of worldwide turnover.
Under the Tax Administration Act (Loi sur l'administration fiscale, RLRQ, c. A-6.002), Quebec businesses and self-employed workers must keep all books and records (including financial records, invoices, receipts, contracts, payroll records, and tax returns) for a minimum of 6 years after the end of the fiscal year to which they relate. If an assessment is under objection or appeal, records must be kept until the matter is finally resolved, even if this exceeds 6 years. The same 6-year minimum applies under the federal Income Tax Act and the Excise Tax Act for records supporting GST/HST filings. Electronic records are acceptable if they are stored in an accessible and legible format throughout the retention period. Failure to maintain adequate books and records is an offence under both the provincial and federal tax statutes and can result in penalties and adverse inferences during audits.
Under the Act respecting the protection of personal information in the private sector (RLRQ, c. P-39.1) as amended by Law 25, personal information that is no longer required for the purpose for which it was collected must be destroyed in a secure manner or anonymized so it can no longer identify any individual. For paper records, secure destruction means shredding using a cross-cut or micro-cut shredder, not simply placing records in a recycling bin. For electronic records, secure destruction means using certified data wiping software, degaussing (for magnetic media), or physical destruction of storage media. Anonymization must be done in a way that makes it impossible to re-identify the individual, taking into account all means of identification that are reasonably foreseeable. The Commission d'accès à l'information (CAI) has provided guidance on what constitutes adequate anonymization under Quebec law.
In Quebec, a data retention policy should address all categories of personal information collected by the enterprise, including: customer information (name, contact details, purchase history, payment information); employee information (personal details, payroll records, performance evaluations, medical information); job applicant information (resumes, interview notes, reference checks); supplier and contractor information (personal information of contact persons); website and app user data (IP addresses, cookies, browsing behaviour, login credentials); and any other information that could identify a natural person, directly or indirectly. The retention period for each category depends on the purpose for which the information was collected, applicable legal requirements (tax records: 6 years; employment records: 6 years after last transaction; certain health records may have longer retention requirements), and business necessity. The policy should specify the retention trigger (e.g., date of last transaction, date of termination) for each category.
A Data Retention Policy — Quebec does not legally require a lawyer in Quebec, and individuals and businesses may draft and execute the document independently. However, seeking independent legal advice from a qualified Quebec lawyer is recommended for transactions involving substantial financial value, complex regulatory requirements, or cross-border elements where multiple legal jurisdictions may apply. A lawyer can verify that the document complies with all applicable statutory requirements, identify potential risks specific to the transaction, and confirm that the terms adequately protect the interests of all parties involved. The Superior Court of Québec has jurisdiction over disputes arising from this type of document, and Registraire des entreprises du Québec may impose additional compliance obligations depending on the nature of the underlying transaction. Professional legal review is particularly advisable where the document will be submitted to government agencies or used as evidence in legal proceedings.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Convention d'arbitrage — Québec (C.c.Q. arts. 2638-2643, C.p.c. arts. 620-655)
Créez une Convention d'arbitrage québécoise juridiquement contraignante pour régler les différends commerciaux hors tribunal. Régie par le C.c.Q. arts. 2638-2643 et le C.p.c. arts. 620-655. Supporte le compromis (différend existant) et la clause compromissoire (différends futurs). Couvre les règles d'arbitrage (CCAC/CCI/ICDR/ad hoc), le nombre d'arbitres, le siège, la langue, la confidentialité et les frais. La sentence est finale (art. 2643 C.c.Q.). PDF ou Word.
Accord de distribution exclusive (Québec)
Créez un accord de distribution exclusive complet au Québec couvrant le territoire exclusif, les engagements d'achats minimums, les prix, les obligations marketing, la non-concurrence, la propriété intellectuelle et la résiliation selon le droit civil québécois et la Loi sur la concurrence.
Accord-cadre fournisseur — Québec (C.c.Q. arts. 1708–2129)
Créez un Accord-cadre fournisseur québécois complet établissant les conditions générales pour l'approvisionnement continu en biens et/ou services. Régi par le C.c.Q. arts. 1708–1805 (vente), arts. 2098–2129 (contrat de service) et art. 1375 (bonne foi). Couvre tarification, livraison, paiement, qualité, garantie, limitation de responsabilité, durée et résiliation.
Accord de règlement à l'amiable — Québec
Accord de règlement à l'amiable (transaction) régi par les articles 2631 à 2637 du Code civil du Québec. Règle les différends par concessions mutuelles avec l'autorité de la chose jugée (art. 2633 CCQ). Comprend un paiement monétaire facultatif, une quittance mutuelle, la confidentialité, le non-dénigrement et la discontinuation des procédures.