Disclosure Outside Quebec and Supplier Management

Most SMBs use services hosted outside Quebec:

• Microsoft 365 (Exchange, Teams, SharePoint) — servers in the US or Europe
• Google Workspace — international servers
• AWS, Azure, GCP — depending on the configured region
• Shopify, Salesforce, HubSpot, QuickBooks Online — outside Quebec

Before disclosing information outside Quebec, the law requires a PIA to be carried out (chapter 6) taking into account, notably:

• The sensitivity of the information
• The purpose of its use
• The protective measures (encryption, contractual) that would apply
• The legal regime of the destination jurisdiction

The disclosure can only take place if the PIA demonstrates that the information would receive adequate protection. It must be covered by a written agreement.

When you entrust information to an agent (host, payroll service, CRM, etc.), disclosure can take place without consent if you have a written contract providing for:

• The protective measures to be followed
• Use limited to the intended purposes
• An obligation to notify the Privacy Officer of any incident or attempted breach
• Destruction or return of the information at the end of the contract
• The organization's right of verification (audits)
• A ban on subcontracting without authorization

See the supplier contract clause template (chapter 13).

1. Inventory all suppliers who process personal information (CRM, HR, accounting, marketing, etc.)
2. Locate where the data is hosted (Quebec, Canada, United States, Europe, etc.)
3. Carry out a PIA for each disclosure outside Quebec not yet assessed
4. Update contracts with the required clauses — use the chapter 13 template
5. Document the inventory and PIAs to demonstrate compliance