Quebec’s Act to modernize legislative provisions as regards the protection of personal information — commonly known as Law 25 — is now fully in force. For SMBs, this means concrete technological obligations.
What the law requires
Law 25 is not just about internal policies. It imposes specific technical measures:
- Personal data inventory: You must know where your data is, who accesses it and why.
- Multi-factor authentication: Access to systems containing personal information must be protected by two-factor authentication.
- Encryption: Sensitive data, especially in transit, must be encrypted.
- Access management: Access must be limited to what is strictly necessary (principle of least privilege).
- Incident response plan: You must have a documented process to detect, contain and report incidents.
Consequences of non-compliance
The Commission d’accès à l’information (CAI) can impose fines of up to $25 million or 4% of worldwide turnover for serious violations. Beyond penalties, a privacy incident can permanently damage your reputation and your clients’ trust.
The Pilote TI approach
We support SMBs in achieving technical compliance, documenting the measures in place and aligning them with legal requirements. Our approach is technical, not legal: we help you implement best practices, but we recommend consulting a lawyer for the legal aspects.
Typical steps in our process:
- Mapping of systems and personal data
- Implementing multi-factor authentication on all services
- Reviewing access rights and removing unnecessary access
- Configuring encrypted backups and testing restoration
- Documenting measures for presentation to authorities or insurers
In summary
Law 25 is not optional. SMBs that have not yet acted are exposed to real risks. The good news: most of the required measures are also good IT practices you should have in place anyway.
This content is provided for informational purposes only and does not constitute legal advice. Consult a legal professional for the specific obligations applicable to your business.