Law 25: what your software should let you do
Quebec's Law 25 has been fully in force since September 2024. Does your software help you comply, or does it get in the way?
Law 25 modernizes the protection of personal information in Quebec. Its obligations came into force in stages, from 2022 to 2024. It applies to every business, whatever its size, as soon as it keeps information about customers or employees.
This article is not legal advice. It helps you check one thing: does your software let you meet your obligations?
1. Know where your data is
When your information is spread across several programs, it is hard to say where each customer record lives. List your software. For each one, note what it holds and where the vendor stores the data.
2. Control who sees what
The person handling the schedule does not need to see payroll. Check that each tool lets you limit access based on each person's role.
3. Hand people their data when they ask
Since September 2024, a person can ask to receive their information in a structured, commonly used format. If that information is scattered across five tools, answering becomes real work.
4. Delete what you no longer need
Personal information should not be kept forever. Your software should let you delete or anonymize a record once there is no longer a reason to keep it.
5. Keep track of incidents
If data leaks, you must record it in a register. If the risk is serious, you must also notify the Commission d'accès à l'information and the people affected. Software that keeps an access history helps you understand what happened.
Fewer tools, fewer risks
Every extra piece of software is one more place your data travels. Bringing your tools together also makes compliance simpler.
For legal questions, talk to a professional. To find out whether your tools make the job easier, talk to us.