[{"data":1,"prerenderedAt":556},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template":45,"post-alt-\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template":533,"post-rel-\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template":535},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":490,"date":491,"description":492,"extension":493,"faq":494,"keyword":507,"meta":508,"minutes":23,"navigation":412,"path":509,"rawbody":510,"seo":511,"sources":512,"stem":525,"tags":526,"translationKey":530,"updated":531,"__hash__":532},"blog_en\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template.md","Confidentiality Incident Register: A Law 25 Template",{"type":49,"value":50,"toc":481},"minimark",[51,55,58,61,87,92,95,98,113,116,119,123,126,156,160,163,348,352,356,359,365,371,380,384,387,390,397,401,458,471,478],[52,53,54],"p",{},"March, in the thick of tax season. An assistant at a bookkeeping practice in Kirkland emails a client’s T4 slip to a different client with the same name. The recipient politely flags it and deletes the email. No risk of serious injury, no notice to the CAI. Case closed?",[52,56,57],{},"Not quite. That incident still has to be recorded in the confidentiality incident register. It is the Law 25 obligation businesses forget most often, precisely because it covers every incident, even the mundane ones.",[52,59,60],{},"The good news: a compliant register fits in a spreadsheet. Here is what it must contain, a template you can copy and filled-in examples.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,78,81,84],"ul",{},[70,71,72,73,77],"li",{},"Every business must keep a register of ",[74,75,76],"strong",{},"all"," its confidentiality incidents, whether or not they present a risk of serious injury (s. 3.8).",[70,79,80],{},"The Regulation respecting confidentiality incidents sets eight mandatory items (s. 7).",[70,82,83],{},"Entries must be kept up to date and retained for at least five years after you became aware of the incident (s. 8).",[70,85,86],{},"The CAI can ask for a copy at any time.",[88,89,91],"h2",{"id":90},"what-the-law-requires-and-for-which-incidents","What the law requires, and for which incidents",[52,93,94],{},"Section 3.8 of the Act respecting the protection of personal information in the private sector is short: the business must keep a register of confidentiality incidents and provide a copy to the CAI on request.",[52,96,97],{},"Everything hinges on the definition in section 3.6. A confidentiality incident is:",[99,100,101,104,107,110],"ol",{},[70,102,103],{},"access to personal information not authorized by law;",[70,105,106],{},"use of it not authorized by law;",[70,108,109],{},"communication of it not authorized by law;",[70,111,112],{},"its loss, or any other breach of its protection.",[52,114,115],{},"In a typical SMB, that means: an email to the wrong recipient, an employee snooping in a customer file out of curiosity, a lost USB key, a compromised Microsoft 365 account, ransomware. The CAI is explicit that the register also includes incidents that present no risk of serious injury.",[52,117,118],{},"Incidents at your vendors count too. If your payroll provider or MSP suffers a breach involving your employees’ or clients’ information, it belongs in your register, not just theirs.",[88,120,122],{"id":121},"the-eight-mandatory-items","The eight mandatory items",[52,124,125],{},"Section 7 of the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1) requires:",[99,127,128,131,134,137,140,143,150,153],{},[70,129,130],{},"a description of the personal information involved, or why it cannot be described;",[70,132,133],{},"a brief description of the circumstances;",[70,135,136],{},"the date or period of the incident, or an approximation;",[70,138,139],{},"the date or period when you became aware of it;",[70,141,142],{},"the number of people affected, or an approximation;",[70,144,145,146,149],{},"the factors that led you to conclude whether ",[74,147,148],{},"or not"," there is a risk of serious injury: sensitivity, possible ill-intentioned uses, anticipated consequences, likelihood of injurious use;",[70,151,152],{},"if the risk is serious, the dates of the notices to the CAI and to individuals, and whether any public notice was issued and why;",[70,154,155],{},"a brief description of the measures taken to reduce the risk of injury.",[88,157,159],{"id":158},"copy-ready-register-template","Copy-ready register template",[52,161,162],{},"Rebuild this table in a spreadsheet: one row per incident, one column per field. Numbered fields are required by the Regulation; lettered fields are recommended to make follow-up easier. The example uses the Kirkland T4 incident.",[164,165,166,185],"table",{},[167,168,169],"thead",{},[170,171,172,176,179,182],"tr",{},[173,174,175],"th",{},"Field",[173,177,178],{},"Status",[173,180,181],{},"What to enter",[173,183,184],{},"Filled-in example",[186,187,188,203,217,230,243,256,269,282,296,309,322,335],"tbody",{},[170,189,190,194,197,200],{},[191,192,193],"td",{},"A. Incident number",[191,195,196],{},"Recommended",[191,198,199],{},"Unique identifier",[191,201,202],{},"INC-2026-004",[170,204,205,208,211,214],{},[191,206,207],{},"1. Information involved",[191,209,210],{},"Required",[191,212,213],{},"Types of information, not the data itself",[191,215,216],{},"Name, address, SIN and employment income (T4 slip)",[170,218,219,222,224,227],{},[191,220,221],{},"2. Circumstances",[191,223,210],{},[191,225,226],{},"What happened, in two or three sentences",[191,228,229],{},"Slip emailed to another client with the same name",[170,231,232,235,237,240],{},[191,233,234],{},"3. Incident date",[191,236,210],{},[191,238,239],{},"Date or period, or approximation",[191,241,242],{},"2026-03-10, 2:12 p.m.",[170,244,245,248,250,253],{},[191,246,247],{},"4. Date of awareness",[191,249,210],{},[191,251,252],{},"Starts the retention clock",[191,254,255],{},"2026-03-10, 3:30 p.m.",[170,257,258,261,263,266],{},[191,259,260],{},"5. People affected",[191,262,210],{},[191,264,265],{},"Number or approximation",[191,267,268],{},"1",[170,270,271,274,276,279],{},[191,272,273],{},"6. Risk analysis",[191,275,210],{},[191,277,278],{},"Sensitivity, possible misuse, consequences, likelihood, conclusion",[191,280,281],{},"SIN is sensitive, but recipient identified, acting in good faith, deletion confirmed in writing. Low likelihood. No serious risk",[170,283,284,287,290,293],{},[191,285,286],{},"7. Notices sent",[191,288,289],{},"Required if serious risk",[191,291,292],{},"Dates of notices to the CAI and individuals; public notice and reason",[191,294,295],{},"N\u002FA",[170,297,298,301,303,306],{},[191,299,300],{},"8. Measures taken",[191,302,210],{},[191,304,305],{},"Actions to reduce the risk",[191,307,308],{},"Written confirmation of deletion; client informed as a courtesy",[170,310,311,314,316,319],{},[191,312,313],{},"B. Privacy officer consulted",[191,315,196],{},[191,317,318],{},"Date and name (s. 3.7)",[191,320,321],{},"2026-03-11, privacy officer",[170,323,324,327,329,332],{},[191,325,326],{},"C. Root cause and prevention",[191,328,196],{},[191,330,331],{},"Steps to prevent recurrence (s. 3.5)",[191,333,334],{},"Tax slips sent via secure portal, two-person check",[170,336,337,340,342,345],{},[191,338,339],{},"D. Status",[191,341,196],{},[191,343,344],{},"Open or closed, last update date",[191,346,347],{},"Closed, 2026-03-14",[349,350],"cta",{"variant":351},"audit",[88,353,355],{"id":354},"two-more-example-entries","Two more example entries",[52,357,358],{},"The same template handles very different incidents. Field 6 is where they diverge.",[52,360,361,364],{},[74,362,363],{},"Compromised mailbox at a Montréal real estate brokerage."," An attacker has access to a broker’s mailbox for four days. It holds copies of driver’s licences and proof of income for roughly 140 buyers. Field 6: sensitive information, malicious actor, high likelihood of identity fraud, so serious risk. Field 7: dates of the CAI notice and individual notices. Field 8: password reset, sessions revoked, forwarding rule removed, MFA enforced.",[52,366,367,370],{},[74,368,369],{},"Curiosity browsing at a veterinary clinic in Gatineau."," An employee opens the file of a client who happens to be her neighbour, for no work reason. Nothing was copied or shared. Field 6: contact details and billing history, no disclosure, low likelihood: no serious risk. Field 8: meeting with the employee, confidentiality undertaking re-signed, access rights reviewed.",[52,372,373,374,379],{},"Audit logs are invaluable for filling fields 3 to 5 accurately. If you are not sure yours are turned on, our ",[375,376,378],"a",{"href":377},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","Microsoft 365 security audit"," article explains what to check.",[88,381,383],{"id":382},"retention-and-protection-of-the-register","Retention and protection of the register",[52,385,386],{},"Register entries must be kept up to date and retained for at least five years after the date or period you became aware of the incident (Regulation, s. 8). If an investigation later shows 300 people were affected instead of 40, update the existing entry rather than creating a new one.",[52,388,389],{},"If your business is also subject to PIPEDA, the Office of the Privacy Commissioner of Canada requires breach records to be kept for two years. Keeping them for five covers both regimes.",[52,391,392,393,396],{},"The register is itself a sensitive document. Describe the ",[74,394,395],{},"types"," of information without copying SINs or files into it. Restrict access to the privacy officer and leadership, and include the file in your backups.",[88,398,400],{"id":399},"check-your-register-in-five-minutes","Check your register in five minutes",[67,402,405,416,423,430,437,444,451],{"className":403},[404],"contains-task-list",[70,406,409,415],{"className":407},[408],"task-list-item",[410,411],"input",{"disabled":412,"type":413,"aria-label":414},true,"checkbox","Incidents not reported to the CAI are in it too."," Incidents not reported to the CAI are in it too.",[70,417,419,422],{"className":418},[408],[410,420],{"disabled":412,"type":413,"aria-label":421},"Field 6 justifies the conclusion instead of just saying “low.”"," Field 6 justifies the conclusion instead of just saying “low.”",[70,424,426,429],{"className":425},[408],[410,427],{"disabled":412,"type":413,"aria-label":428},"Incident date and date of awareness are recorded separately."," Incident date and date of awareness are recorded separately.",[70,431,433,436],{"className":432},[408],[410,434],{"disabled":412,"type":413,"aria-label":435},"Incidents that happened at your vendors are included."," Incidents that happened at your vendors are included.",[70,438,440,443],{"className":439},[408],[410,441],{"disabled":412,"type":413,"aria-label":442},"No personal information is copied into it unnecessarily."," No personal information is copied into it unnecessarily.",[70,445,447,450],{"className":446},[408],[410,448],{"disabled":412,"type":413,"aria-label":449},"Entries are updated as the investigation progresses."," Entries are updated as the investigation progresses.",[70,452,454,457],{"className":453},[408],[410,455],{"disabled":412,"type":413,"aria-label":456},"A named person is responsible for keeping it."," A named person is responsible for keeping it.",[52,459,460,461,465,466,470],{},"To know when an incident must also be reported, see our guide to ",[375,462,464],{"href":463},"\u002Fen\u002Fblog\u002Freport-confidentiality-incident-cai-law-25","reporting a confidentiality incident to the CAI",". The register is only one piece: our ",[375,467,469],{"href":468},"\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist","Law 25 cybersecurity checklist"," covers the rest.",[52,472,473,474,477],{},"This template is provided for information only and is not legal advice: validate it with your legal counsel before adopting it. If you would like a second set of eyes on your register and the safeguards around it, ",[375,475,476],{"href":17},"our Law 25 compliance service"," can help.",[349,479],{"variant":480},"devis",{"title":482,"searchDepth":11,"depth":15,"links":483},"",[484,485,486,487,488,489],{"id":90,"depth":11,"text":91},{"id":121,"depth":11,"text":122},{"id":158,"depth":11,"text":159},{"id":354,"depth":11,"text":355},{"id":382,"depth":11,"text":383},{"id":399,"depth":11,"text":400},"compliance","2026-10-24","The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules.","md",[495,498,501,504],{"q":496,"a":497},"Is a simple Excel spreadsheet acceptable as an incident register?","Yes. Neither the Act nor the Regulation prescribes a format. What matters is that the eight mandatory items are there and that the file is kept up to date. Version history (SharePoint, Google Drive) also helps show entries were not changed after the fact.",{"q":499,"a":500},"Does a blocked phishing attempt need to go in the register?","Not if no personal information was accessed, used, communicated or lost: in that case it is not a confidentiality incident under section 3.6. Log it in your security log instead. If the employee entered their password and the mailbox was accessed, however, the incident must be recorded.",{"q":502,"a":503},"Do incidents involving only employee information count?","Yes. The Act protects all personal information the business holds, including its staff’s: HR files, payroll, SINs, emergency contacts. A pay stub sent to the wrong employee is an incident to record.",{"q":505,"a":506},"Who should keep the register in a small business?","The Act places the obligation on the business without naming a role. In practice, the person in charge of the protection of personal information usually keeps it, since they must be consulted to assess the risk of injury for each incident.","confidentiality incident register template",{},"\u002Fen\u002Fblog\u002Fconfidentiality-incident-register-template","---\ntitle: \"Confidentiality Incident Register: A Law 25 Template\"\ndescription: \"The confidentiality incident register Québec’s Law 25 requires: the 8 mandatory fields, a copy-ready template, filled-in examples and retention rules.\"\ndate: 2026-10-24\ncategory: compliance\ntags: [\"law 25\", \"incident register\", \"template\", \"compliance\"]\ntranslationKey: registre-incidents\nkeyword: \"confidentiality incident register template\"\nfaq:\n  - q: \"Is a simple Excel spreadsheet acceptable as an incident register?\"\n    a: \"Yes. Neither the Act nor the Regulation prescribes a format. What matters is that the eight mandatory items are there and that the file is kept up to date. Version history (SharePoint, Google Drive) also helps show entries were not changed after the fact.\"\n  - q: \"Does a blocked phishing attempt need to go in the register?\"\n    a: \"Not if no personal information was accessed, used, communicated or lost: in that case it is not a confidentiality incident under section 3.6. Log it in your security log instead. If the employee entered their password and the mailbox was accessed, however, the incident must be recorded.\"\n  - q: \"Do incidents involving only employee information count?\"\n    a: \"Yes. The Act protects all personal information the business holds, including its staff’s: HR files, payroll, SINs, emergency contacts. A pay stub sent to the wrong employee is an incident to record.\"\n  - q: \"Who should keep the register in a small business?\"\n    a: \"The Act places the obligation on the business without naming a role. In practice, the person in charge of the protection of personal information usually keeps it, since they must be consulted to assess the risk of injury for each incident.\"\nsources:\n  - title: \"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.6 and 3.8\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1\"\n  - title: \"Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1), ss. 7 and 8\"\n    url: \"https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcr\u002FA-2.1,%20r.%203.1\"\n  - title: \"CAI — Confidentiality incidents and security measures for businesses (French)\"\n    url: \"https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fprotection-renseignements-personnels\u002Finformation-entreprises-privees\u002Fincidents-confidentialite-mesures-securite-entreprises\"\n  - title: \"Office of the Privacy Commissioner of Canada — Mandatory reporting of breaches of security safeguards\"\n    url: \"https:\u002F\u002Fwww.priv.gc.ca\u002Fen\u002Fprivacy-topics\u002Fprivacy-for-businesses\u002Fprivacy-breaches-at-your-business\u002Fgd_pb_201810\u002F\"\n---\n\nMarch, in the thick of tax season. An assistant at a bookkeeping practice in Kirkland emails a client’s T4 slip to a different client with the same name. The recipient politely flags it and deletes the email. No risk of serious injury, no notice to the CAI. Case closed?\n\nNot quite. That incident still has to be recorded in the confidentiality incident register. It is the Law 25 obligation businesses forget most often, precisely because it covers every incident, even the mundane ones.\n\nThe good news: a compliant register fits in a spreadsheet. Here is what it must contain, a template you can copy and filled-in examples.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- Every business must keep a register of **all** its confidentiality incidents, whether or not they present a risk of serious injury (s. 3.8).\n- The Regulation respecting confidentiality incidents sets eight mandatory items (s. 7).\n- Entries must be kept up to date and retained for at least five years after you became aware of the incident (s. 8).\n- The CAI can ask for a copy at any time.\n::\n\n## What the law requires, and for which incidents\n\nSection 3.8 of the Act respecting the protection of personal information in the private sector is short: the business must keep a register of confidentiality incidents and provide a copy to the CAI on request.\n\nEverything hinges on the definition in section 3.6. A confidentiality incident is:\n\n1. access to personal information not authorized by law;\n2. use of it not authorized by law;\n3. communication of it not authorized by law;\n4. its loss, or any other breach of its protection.\n\nIn a typical SMB, that means: an email to the wrong recipient, an employee snooping in a customer file out of curiosity, a lost USB key, a compromised Microsoft 365 account, ransomware. The CAI is explicit that the register also includes incidents that present no risk of serious injury.\n\nIncidents at your vendors count too. If your payroll provider or MSP suffers a breach involving your employees’ or clients’ information, it belongs in your register, not just theirs.\n\n## The eight mandatory items\n\nSection 7 of the Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1) requires:\n\n1. a description of the personal information involved, or why it cannot be described;\n2. a brief description of the circumstances;\n3. the date or period of the incident, or an approximation;\n4. the date or period when you became aware of it;\n5. the number of people affected, or an approximation;\n6. the factors that led you to conclude whether **or not** there is a risk of serious injury: sensitivity, possible ill-intentioned uses, anticipated consequences, likelihood of injurious use;\n7. if the risk is serious, the dates of the notices to the CAI and to individuals, and whether any public notice was issued and why;\n8. a brief description of the measures taken to reduce the risk of injury.\n\n## Copy-ready register template\n\nRebuild this table in a spreadsheet: one row per incident, one column per field. Numbered fields are required by the Regulation; lettered fields are recommended to make follow-up easier. The example uses the Kirkland T4 incident.\n\n| Field | Status | What to enter | Filled-in example |\n|---|---|---|---|\n| A. Incident number | Recommended | Unique identifier | INC-2026-004 |\n| 1. Information involved | Required | Types of information, not the data itself | Name, address, SIN and employment income (T4 slip) |\n| 2. Circumstances | Required | What happened, in two or three sentences | Slip emailed to another client with the same name |\n| 3. Incident date | Required | Date or period, or approximation | 2026-03-10, 2:12 p.m. |\n| 4. Date of awareness | Required | Starts the retention clock | 2026-03-10, 3:30 p.m. |\n| 5. People affected | Required | Number or approximation | 1 |\n| 6. Risk analysis | Required | Sensitivity, possible misuse, consequences, likelihood, conclusion | SIN is sensitive, but recipient identified, acting in good faith, deletion confirmed in writing. Low likelihood. No serious risk |\n| 7. Notices sent | Required if serious risk | Dates of notices to the CAI and individuals; public notice and reason | N\u002FA |\n| 8. Measures taken | Required | Actions to reduce the risk | Written confirmation of deletion; client informed as a courtesy |\n| B. Privacy officer consulted | Recommended | Date and name (s. 3.7) | 2026-03-11, privacy officer |\n| C. Root cause and prevention | Recommended | Steps to prevent recurrence (s. 3.5) | Tax slips sent via secure portal, two-person check |\n| D. Status | Recommended | Open or closed, last update date | Closed, 2026-03-14 |\n\n::cta{variant=\"audit\"}\n::\n\n## Two more example entries\n\nThe same template handles very different incidents. Field 6 is where they diverge.\n\n**Compromised mailbox at a Montréal real estate brokerage.** An attacker has access to a broker’s mailbox for four days. It holds copies of driver’s licences and proof of income for roughly 140 buyers. Field 6: sensitive information, malicious actor, high likelihood of identity fraud, so serious risk. Field 7: dates of the CAI notice and individual notices. Field 8: password reset, sessions revoked, forwarding rule removed, MFA enforced.\n\n**Curiosity browsing at a veterinary clinic in Gatineau.** An employee opens the file of a client who happens to be her neighbour, for no work reason. Nothing was copied or shared. Field 6: contact details and billing history, no disclosure, low likelihood: no serious risk. Field 8: meeting with the employee, confidentiality undertaking re-signed, access rights reviewed.\n\nAudit logs are invaluable for filling fields 3 to 5 accurately. If you are not sure yours are turned on, our [Microsoft 365 security audit](\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit) article explains what to check.\n\n## Retention and protection of the register\n\nRegister entries must be kept up to date and retained for at least five years after the date or period you became aware of the incident (Regulation, s. 8). If an investigation later shows 300 people were affected instead of 40, update the existing entry rather than creating a new one.\n\nIf your business is also subject to PIPEDA, the Office of the Privacy Commissioner of Canada requires breach records to be kept for two years. Keeping them for five covers both regimes.\n\nThe register is itself a sensitive document. Describe the **types** of information without copying SINs or files into it. Restrict access to the privacy officer and leadership, and include the file in your backups.\n\n## Check your register in five minutes\n\n- [ ] Incidents not reported to the CAI are in it too.\n- [ ] Field 6 justifies the conclusion instead of just saying “low.”\n- [ ] Incident date and date of awareness are recorded separately.\n- [ ] Incidents that happened at your vendors are included.\n- [ ] No personal information is copied into it unnecessarily.\n- [ ] Entries are updated as the investigation progresses.\n- [ ] A named person is responsible for keeping it.\n\nTo know when an incident must also be reported, see our guide to [reporting a confidentiality incident to the CAI](\u002Fen\u002Fblog\u002Freport-confidentiality-incident-cai-law-25). The register is only one piece: our [Law 25 cybersecurity checklist](\u002Fen\u002Fblog\u002Fquebec-law-25-cybersecurity-checklist) covers the rest.\n\nThis template is provided for information only and is not legal advice: validate it with your legal counsel before adopting it. If you would like a second set of eyes on your register and the safeguards around it, [our Law 25 compliance service](\u002Fen\u002Fservices\u002Flaw-25-compliance) can help.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":492},[513,516,519,522],{"title":514,"url":515},"Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.6 and 3.8","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcs\u002FP-39.1",{"title":517,"url":518},"Regulation respecting confidentiality incidents (CQLR c. A-2.1, r. 3.1), ss. 7 and 8","https:\u002F\u002Fwww.legisquebec.gouv.qc.ca\u002Fen\u002Fdocument\u002Fcr\u002FA-2.1,%20r.%203.1",{"title":520,"url":521},"CAI — Confidentiality incidents and security measures for businesses (French)","https:\u002F\u002Fwww.cai.gouv.qc.ca\u002Fprotection-renseignements-personnels\u002Finformation-entreprises-privees\u002Fincidents-confidentialite-mesures-securite-entreprises",{"title":523,"url":524},"Office of the Privacy Commissioner of Canada — Mandatory reporting of breaches of security safeguards","https:\u002F\u002Fwww.priv.gc.ca\u002Fen\u002Fprivacy-topics\u002Fprivacy-for-businesses\u002Fprivacy-breaches-at-your-business\u002Fgd_pb_201810\u002F","en\u002Fblog\u002Fconfidentiality-incident-register-template",[527,528,529,490],"law 25","incident register","template","registre-incidents",null,"ynEM34O_YbZPiqCDT2IUsn42EudSGaubvKqyDOgXmZ0",{"path":534},"\u002Fblogue\u002Fregistre-incidents-confidentialite-modele",[536,544,549],{"path":537,"title":538,"description":539,"category":490,"minutes":23,"tags":540},"\u002Fen\u002Fblog\u002Fcyberattack-who-to-notify-canada","Cyberattack: Who to Notify in Canada, and in What Order","Hit by a cyberattack? Who to notify in Canada (insurer, bank, police, CAI, OPC, clients, Cyber Centre), in what order and under which law, step by step.",[541,527,542,543,490],"incident response","pipeda","breach notification",{"path":463,"title":545,"description":546,"category":490,"minutes":23,"tags":547},"Law 25 Breach Notification: Reporting an Incident to the CAI","When and how to report a confidentiality incident to Québec’s CAI under Law 25, minus the 72-hour myth: harm assessment, notice content and next steps.",[527,548,541,490],"cai",{"path":550,"title":551,"description":552,"category":490,"minutes":27,"tags":553},"\u002Fen\u002Fblog\u002Flaw-25-privacy-policy-template","Law 25 Privacy Policy: Required Content and a Template","Quebec Law 25 privacy policy: who must publish one, what it must contain under ss. 8, 8.1 and 8.2, a template outline to adapt, and the mistakes to avoid.",[527,554,490,555],"privacy policy","website",1792972905277]