At your 30-person company, who is in charge of protecting personal information? If nobody has signed anything, the answer is simple: the president or CEO. Section 3.1 of the Act, as amended by Law 25, assigns the role by default to the person exercising the highest authority. Plenty of executives find out the day an incident hits.
At other SMBs, the role was handed off in a hurry to the office manager “because she already looks after the computers.” Her title is on the website, but she has neither the budget nor the authority to make the sales director turn on MFA.
Yet the Act puts this person at the centre of several security decisions. In English, the statute calls the role the “person in charge of the protection of personal information”; most people just say privacy officer. Here is what the role involves on the security side, and how to equip it.
TL;DR
- By default, the privacy officer is the person with the highest authority; they can delegate the function in writing, in whole or in part (s. 3.1).
- The officer’s title and contact information must be published on the company website.
- The officer is involved in privacy impact assessments (s. 3.3), injury assessment during incidents (s. 3.7) and receiving breach notices from vendors (s. 18.3).
- Delegating does not transfer accountability: senior management remains responsible.
Who holds the role by default, and how to delegate
Section 3.1 is clear: the business is responsible for the personal information it holds, and the person with the highest authority ensures the Act is complied with. That person exercises the privacy officer function but may delegate all or part of it, in writing, to any person.
The CAI stresses two points:
- even after delegating, the person with the highest authority remains accountable for compliance;
- they must back the delegate with the necessary human, technical and financial resources.
In practice, delegate to someone who can make things happen: secure a budget, impose a rule on a manager, pause a project. Delegation without authority is delegation in name only.
If your business is also subject to federal PIPEDA, its accountability principle likewise requires designating someone responsible for compliance. Aligning both roles in one person usually makes sense.
The officer’s security-related duties
The Act and the CAI assign the privacy officer several functions. These have a direct security dimension:
| Duty | Section | What it means for security |
|---|---|---|
| Approve governance policies | 3.2 | Sign off on retention, destruction and staff roles |
| Be consulted from the start of any system project | 3.3 | Ask the security questions before the purchase, not after |
| Assess the risk of injury after an incident | 3.7 | Join the triage with IT, often under pressure |
| Record disclosures made to reduce a risk | 3.5 | Keep track of information shared with a bank or an expert |
| Receive breach notices from vendors | 18.3 | Be the named contact in vendor contracts |
| Answer access requests within 30 days | 30 and 32 | Verify the requester’s identity so you do not cause an incident yourself |
That last point is often overlooked. A fake access request from someone posing as a client is a very real social engineering technique. The Act requires requests to be made in writing by a person who proves their identity (s. 30).
Privacy officer and IT: who does what
The privacy officer does not need to configure a firewall. Their job is to make sure the right decisions are made and documented. Here is a realistic split in an SMB that relies on a managed service provider:
| Activity | Leadership | Privacy officer | IT or MSP |
|---|---|---|---|
| Choose security measures | Funds | Validates against information sensitivity | Proposes and prices |
| Configure MFA, backups, access | Informed | Checks it is done | Implements |
| Incident triage | Decides on notices | Assesses injury, keeps the register | Detects, contains, provides logs |
| Staff training | Supports | Organizes | Provides technical content |
One piece of advice: avoid naming your MSP as privacy officer. They would end up assessing their own work.
Section 18.3 also gives the officer an underused lever. Any vendor you entrust with personal information under a mandate or service contract must notify the officer without delay of any breach or attempted breach of confidentiality, and must allow the officer to carry out any verification relating to that confidentiality (exceptions exist, for example for members of a professional order). For a Gatineau engineering firm that outsources payroll, HR files and cloud hosting to three different vendors, that is solid footing to ask for a SOC 2 report, an access list or penetration test results.
The officer’s quarterly dashboard
Once a quarter, the privacy officer should be able to answer these questions, with evidence:
- What share of accounts is protected by MFA? (Target: 100%.)
- Has the list of admin accounts been reviewed?
- Have all departed employees’ accounts been disabled?
- When was the last successful backup restore test?
- Are critical patches applied on workstations and servers?
- What new entries are in the incident register, and were the promised measures carried out?
- Which current projects require a privacy impact assessment?
- Do new vendor contracts include security and notice clauses?
- What were the results of the latest phishing simulation or training?
Present this dashboard to leadership. It is also what the CAI expects from engaged management: approving security measures, promoting them and providing resources.
Written delegation template
The Act requires delegation in writing but sets no format. Here is a starting point to adapt:
I, name, title, as the person exercising the highest authority within company, delegate to name, title, effective date, the function of person in charge of the protection of personal information under section 3.1 of the Act respecting the protection of personal information in the private sector, in full / for the following functions: …. Name will have the following resources: time allocated, budget, access to our IT provider. They will report to leadership quarterly.
Signature and date.
Name a backup for absences, too: an incident during the construction holiday in late July will not wait for anyone to get back from the cottage. Keep the signed document with your governance policies.
Pitfalls to avoid
- Delegating to someone with no authority over managers or budget.
- Publishing a personal email or cell number instead of role-based contact details.
- Forgetting to update the website and vendor contracts when the officer leaves.
- Letting the officer discover new software only after it has been bought.
- Treating the role as a one-time task rather than an ongoing function.
This article explains Law 25 in plain terms and is not legal advice: validate your delegation and role split with your legal counsel. If your privacy officer needs regular technical backup, our ongoing security partner service can act as their right hand.
Frequently asked questions
Does the privacy officer need a certification?+
No. The Act requires no degree or certification. The CAI does recommend choosing someone with the required skills and significant decision-making power. Privacy training and a grounding in information security are strong assets.
Can we give the role to an outside consultant?+
Yes. The Act allows the function to be delegated in writing, in whole or in part, to any person, including someone outside the business. The person with the highest authority still remains responsible for implementing the Act. An external officer needs to know your operations well and be quickly reachable during an incident; have the arrangement reviewed by your legal counsel.
Can a company director be held personally liable?+
The Act provides that a director, officer or representative of a legal person who ordered or authorized the act or omission constituting an offence, or who consented to it, is party to the offence (s. 93). That is liability tied to participating in the offence, not automatic liability. Check your situation with your legal counsel.
Do we have to publish the privacy officer’s name on our website?+
The Act requires publishing their title and contact information (s. 3.1), not necessarily their name. A role-based address such as [email protected] means you do not have to update the site every time the person changes.
Sources
- 1.Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), ss. 3.1 to 3.8, 18.3 and 93
- 2.CAI — Business responsibilities and functions of the person in charge of the protection of personal information (French)
- 3.CAI — Preventing confidentiality incidents: checklist for businesses (French, January 2026)