FAQ · Glossary · Official Resources

Yes. The law sets no minimum threshold. As soon as an organization holds personal information (customers, employees), it is generally subject to the law — regardless of size. To confirm your specific situation, consult the CAI.

No. An SMB can handle the essentials with templates and CAI resources. An external advisor remains useful for complex cases (out-of-province PIAs, serious incidents, contracts).

Law 25 governs the private sector in Quebec. PIPEDA (federal) applies to interprovincial and international commercial activities. Since Quebec has its own law, Law 25 generally takes precedence for activities that stay within Quebec.

In some cases for non-sensitive information, yes, when the purpose is obvious and reasonably expected. But for sensitive information and for marketing/profiling, express and separate consent is mandatory.

As long as needed to fulfill the purposes, plus any applicable legal retention periods (tax, etc.). After that, destruction or anonymization. No "just in case" retention.

No. Every incident goes in the register, but only those presenting a risk of serious harm must be notified to the CAI and the individuals concerned.

Yes, it's an unauthorized disclosure. Log it in the register, then assess the risk of serious harm based on the data's sensitivity and the context.

Yes. The law applies to the information you currently hold, regardless of when it was originally collected.

Assess the request against the applicable rights (de-indexing/cessation, rectification by deleting unlawfully held data). Document your decision and give reasons for any refusal, indicating available recourse (CAI).

Indirectly but genuinely: as soon as an AI processes personal information or makes automated decisions, transparency obligations and the right to contest the decision apply.