Data Protection Policy — Quebec (Politique de protection des données / Loi 25)

A Quebec Data Protection Policy (Politique de protection des données) is an organizational document describing how personal information is collected, used, stored, protected, and shared. Mandated by Law 25 (LPRPSP as amended by Bill 64), it must be published and made accessible to individuals. It is the cornerstone of Law 25 compliance for Quebec businesses. Under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25, CQLR c P-39.1), all organizations operating in Quebec that collect, use, communicate, or retain personal information must implement a data protection policy. Law 25 (as amended by Bill 64, effective in stages from 2022-2023) introduced mandatory privacy impact assessments (PIAs), data minimization obligations, and mandatory breach notification. The Commission d'acces a l'information (CAI) supervises compliance. The Civil Code of Quebec (CCQ) Articles 35-41 provide the foundational right to privacy. The Charter of Human Rights and Freedoms of Quebec (CQLR c C-12), Section 5, reinforces these protections at the quasi-constitutional level. The Superior Court of Quebec has jurisdiction over enforcement actions. Article 37 of the Civil Code of Quebec (CCQ) also grants individuals the right to access and correct their personal information. Organizations must appoint a privacy officer whose name and contact details are published. The Superior Court of Quebec adjudicates civil claims for breach of privacy under CCQ art. 1457.

A data protection policy is mandatory for all Quebec private sector organizations that collect, use, or communicate personal information about individuals. Law 25 requires it to be published and accessible. It must be reviewed and updated regularly.

Parties in Quebec should prepare a Data Protection Policy — Quebec (Politique de protection des données / Loi 25) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution. A data protection policy must be in place before an organization begins collecting personal information from Quebec residents. Law 25 requires organizations to designate a privacy officer, conduct privacy impact assessments (PIAs) for new projects involving personal information, and publish their privacy policy on their website. The CAI enforces the requirement for a published, accessible policy. Organizations subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA, SC 2000, c 5) must also comply with PIPEDA's accountability principle. Revenu Quebec and the Autorite des marches financiers (AMF) impose additional data governance requirements for regulated entities.

Key elements: Privacy Officer identification, types of personal information collected, purposes of collection, legal basis, retention periods, security measures, cross-border transfer rules, individual rights (access, correction, deletion), complaint procedure, cookie policy for websites, and Law 25/CAI compliance references.

Additional compliance elements for a Data Protection Policy — Quebec (Politique de protection des données / Loi 25) used in Quebec include: A Quebec data protection policy must cover: appointment of privacy officer with contact information; categories of personal data collected and purposes; legal basis for collection under Law 25; data retention schedules; third-party sharing and cross-border transfer procedures; security measures protecting data; data subject rights (access, rectification, portability, erasure, withdrawal of consent) under Law 25 ss. 37-40; privacy incident response procedures under Law 25 s. 3.5; privacy impact assessment (PIA) process; and complaint handling procedures before the CAI. The policy must be published in plain language accessible to all data subjects. The CAI may order organizations to amend non-compliant policies. Forms-legal.com provides this Quebec-compliant data protection policy template as a starting point. Article 37 of the Civil Code of Quebec (CCQ) grants individuals the right to access and correct their personal information. Organizations must publish their privacy policy and make it easily accessible to data subjects. The CAI (Commission d'acces a l'information) can order organizations to cease collection or amend policies. Under Law 25 s. 3.5, data breach notifications to the CAI must be made within 72 hours. The Superior Court of Quebec adjudicates civil privacy claims. Consult a Quebec privacy lawyer for complex data governance arrangements. Under Section 3.3 of Law 25, organizations must conduct a privacy impact assessment (PIA) before acquiring or developing any information system involving personal information. The CAI publishes annual enforcement reports and may impose corrective orders. Consult a Quebec privacy lawyer to audit your data protection policy for Law 25 compliance.