Quebec Law 25 Compliance Checklist: The Cybersecurity Side

Your privacy policy is online. Your privacy officer’s title is on the website. For a lot of Montréal businesses, that is where Law 25 work stopped: a handful of documents drafted in a rush in 2023, then nothing.

The trouble is that the law is not tested on paper. It is tested the day a mailbox gets compromised or a laptop is left on the 747 bus. At that point, the real question is whether you had taken “reasonable” security measures, as section 10 of the Act requires.

This checklist turns Law 25’s obligations into cybersecurity controls you can actually verify. It is written for a business of 10 to 100 people with no full-time security team, whether you are headquartered in Québec or in Ottawa with a Montréal office.

What Law 25 requires, translated into IT terms

The Act respecting the protection of personal information in the private sector (CQLR c. P-39.1), as amended by Law 25, uses very little technical language. Several sections still land squarely on your IT environment.

Area 1: governance

Security starts with clear decisions made by someone with the authority to enforce them.

• Your person in charge of the protection of personal information is designated (in writing, if delegated), and their title and contact information are published on your website.
• Governance policies (retention, destruction, roles, complaint handling) are approved by that person and summarized in plain language on your site.
• A one- or two-page security policy exists: passwords, MFA, personal devices, remote work.
• Staff get security awareness training at least once a year, phishing included.
• Leadership reviews security status at least quarterly.

Area 2: inventory and access control

You cannot protect what you have not mapped. The CAI puts a personal information inventory at the heart of its own checklist for businesses, published in January 2026. It also points out that ticking boxes does not make you compliant: each item has to be genuinely in place.

• You have an inventory of personal information: what it is, where it sits (software, server, cloud, paper), who can access it, how long you keep it.
• Sensitive information (SINs, health data, banking details) is flagged.
• Each employee can only reach the information their job requires (s. 20).
• Departing employees’ accounts are disabled on their last day.
• Admin accounts are separate from everyday accounts, and there are few of them.
• Information whose purpose has been fulfilled is destroyed or anonymized (s. 23).

Example: while building its inventory, a West Island accounting firm finds 2014 tax returns still sitting in a shared folder open to every employee, interns included. No hacker required for that to be a problem.

Area 3: baseline technical safeguards

Section 10 calls for measures that are reasonable “given the sensitivity of the information, the purposes for which it is to be used, the quantity and distribution of the information and the medium on which it is stored.” For an SMB in 2026, a reasonable baseline looks like this:

• Multi-factor authentication on email, remote access and every cloud application that holds personal information, ideally phishing-resistant (see our MFA buying guide).
• Security patches applied promptly on workstations, servers, firewalls and business software.
• Automated backups, including an offline or immutable copy, proven by a real restore test.
• Full-disk encryption on laptops and mobile devices.
• Access logs enabled and retained (Microsoft 365, Google Workspace, line-of-business apps).
• SPF, DKIM and DMARC configured on your email domain.
• Managed antivirus or EDR on every endpoint.

These line up with the examples the CAI itself gives: strong passwords, encryption, firewalls, access logging and systematic updates.

Area 4: incident handling

The Act defines a confidentiality incident broadly: unauthorized access, use or communication, loss, or any other breach of the protection of personal information (s. 3.6). An email sent to the wrong client counts.

• A one-page procedure says what to do and who to call during an incident, weekends included.
• You have a way to assess the risk of serious injury: sensitivity, anticipated consequences, likelihood of injurious use (s. 3.7).
• You know how to notify the CAI and affected individuals. Reminder: Law 25 sets no 72-hour deadline; that figure comes from Europe’s GDPR. The Act requires notice “promptly” when an incident presents a risk of serious injury (s. 3.5).
• A confidentiality incident register is kept, minor incidents included (s. 3.8).

For the full walkthrough, read our guide to reporting an incident to the CAI. If you also operate elsewhere in Canada, federal PIPEDA has its own breach rules; map both with counsel.

Area 5: vendors and cloud services

Your personal information often lives with someone else: payroll platform, CRM, managed service provider. You remain responsible for it.

• Every vendor that processes personal information for you has a written contract spelling out its security measures and requiring it to notify your privacy officer without delay of any breach (s. 18.3).
• You know which country hosts your data, and an assessment was done before any transfer outside Québec, including to Ontario or the U.S. (s. 17).
• Your MSP’s access is named, MFA-protected and reviewed regularly.
• A privacy impact assessment precedes the purchase or overhaul of any system touching personal information (s. 3.3).

Where to start: a 90-day plan

Doing everything at once is unrealistic. This order cuts the most risk the fastest.

Keep a record at each step: MFA console screenshot, restore test report, minutes of the leadership meeting. The day the CAI starts asking questions, that file speaks for you.

This checklist is an educational tool, not legal advice: validate how these obligations apply to your organization with your legal counsel. For the technical side, our Law 25 compliance service can start from this list and test it against your real systems.