Confidentiality incident register template (Law 25)
A ready-to-fill spreadsheet with the eight elements required by Québec’s Regulation respecting confidentiality incidents, plus a sample row. Free, no sign-up.
CSV file · opens in Excel, Numbers or Google Sheets
- 1.Description of the personal information concerned
- 2.Brief description of the circumstances
- 3.Date or period of the incident
- 4.Date or period the business became aware
- 5.Number of individuals concerned
- 6.Assessment of the risk of serious injury
- 7.Dates of notices to the CAI and individuals (if serious risk), public notice
- 8.Measures taken to reduce the risk of injury
How to use it
- Record every incident, including harmless misdirected emails: it’s the most often forgotten obligation.
- Document your risk-of-serious-injury assessment, even when the answer is no.
- If the risk is serious, notify the CAI and the individuals concerned promptly, and record the dates.
- Keep each entry for at least five years.
This template is provided for information: validate its use with your legal counsel. For details on each field, read our incident register guide.
Frequently asked questions
Is the register mandatory for a small business?+
Yes. Québec’s private-sector privacy act (s. 3.8) requires every business to keep a register of its confidentiality incidents, including those with no risk of serious injury.
How long must the register be kept?+
At least five years after the date or period the business became aware of the incident (Regulation respecting confidentiality incidents, s. 8).
Can the CAI ask for the register?+
Yes, the business must send a copy to the Commission d’accès à l’information on request.