Quebec's security safeguard rule: what a small business should document

What to take away

Where this applies, and where it does not

This article covers Quebec's private-sector statute (CQLR, chapter P-39.1), as strengthened by Law 25. It applies to personal information collected, held, used or communicated while operating an enterprise, in any format, and the CAI enforces it. Federal PIPEDA and the British Columbia and Alberta PIPA statutes are separate laws, and one business can fall under several. The breach reporting comparison for Canadian small businesses covers notification across those regimes, so this article stays on prevention and documentation.

Section numbers follow the CAI's comparison of the Act dated 14 March 2023, an unofficial reference with no legal value. The Act may have been amended since, so check the current consolidated text before relying on a number.

Section 10: what "reasonable" means in practice

Section 10 requires security measures that protect personal information collected, used, communicated, kept or destroyed, reasonable given its sensitivity, the purpose of its use, its quantity, its distribution and its medium. The Act lists no product, standard or minimum control. Those five factors are the whole test.

The CAI's explanatory guide for businesses (January 2026 edition) turns them into questions:

The guide also separates security from lawfulness. Its examples of good security that still breaches the Act include a secure web form collecting details nobody needs and encrypted records kept after they should have been destroyed.

The CAI's seven steps as a small-business routine

The CAI proposes seven steps: know your obligations, inventory the information and assess its sensitivity, identify and assess risks, choose measures, deploy them, measure their effectiveness, and monitor and revise. For a small firm the inventory does the most work, because every later decision depends on it. A short version of the CAI's table layout:

The CAI's example causes of incidents are weak staff training, poor access management and no retention and destruction policy. To measure results it suggests log analysis, intrusion and vulnerability tests, and checking whether a phishing-awareness campaign changed behaviour.

Editorial suggestion: keep the inventory and the risk list in one file with a review date, and reopen it whenever you add a tool, a line of business or a supplier.

Controls the CAI names, and where the Cyber Centre baseline helps

The CAI guide's technical examples include strong credentials, encryption of communications, stored data and mobile devices, a firewall and perimeter defence, access management with logging and log review, systematic software updates, and secure destruction. Its administrative examples include access limited to staff whose duties require it and staff training on passwords, malware and social engineering.

The Canadian Centre for Cyber Security publishes baseline controls for small and medium organizations (version 1.2, aimed at organizations under 499 employees) that translate several of them. The baseline uses "should" throughout, so these are recommendations, not legal duties:

The baseline has no logging control, so the access logging the CAI mentions has to come from your own design. The guides on small business MFA setup and backup and recovery cover the tools, though neither is Quebec-specific.

The records the Act expects

A named person in charge (section 3.1). The person with the highest authority in the business performs the function of person in charge of the protection of personal information, and may delegate it in writing, in whole or in part. The title and contact details must be published on the website, or by another appropriate means if there is none. The CAI says you do not need to notify it.

Governance policies and practices (section 3.2). The business must establish and apply policies covering at least retention and destruction, staff roles and responsibilities across the life cycle of the information, and a process for privacy complaints. They must be proportionate to the business, approved by the person in charge, and described in simple, clear terms on the website or by another appropriate means.

An incident register (section 3.8). Every confidentiality incident goes in the register, whether or not it triggers notice. The CAI says entries are kept at least five years after the business became aware of the incident, and a copy goes to the CAI on request. Notice rules are in the breach reporting article linked above.

A destruction rule (section 23). Once the purposes of collection are fulfilled, the business must destroy the information or anonymize it for serious and legitimate purposes, subject to any legal retention period.

Access requests (section 32). The person in charge must answer an access or correction request in writing, with diligence and within 30 days of receipt. Silence for 30 days counts as a refusal.

When a new system or an overseas host needs an impact assessment

The CAI's assessment guide (version 3.1, April 2024) lists three situations where a privacy impact assessment is mandatory for private-sector businesses in Quebec: communicating personal information outside Quebec (section 17), acquiring, developing or overhauling an information system or electronic service delivery involving personal information (section 3.3), and communicating information without consent for study, research or statistics (section 21).

The CAI reads "information system" broadly. Its examples include case-management software, videoconferencing tools, video surveillance and payroll systems, so a payroll, videoconferencing or booking system that involves personal information can fall under section 3.3.

Section 3.3 adds three requirements: consult the person in charge from the start, make sure the project can return computerized personal information to the individual in a structured, commonly used technological format, and scale the assessment to the sensitivity, purpose, quantity, distribution and medium of the information.

For transfers outside Quebec, section 17 requires the business to weigh the sensitivity, the purpose, the protections including contractual ones, and the legal regime in the destination. The transfer may proceed only if the assessment shows adequate protection, and it needs a written agreement reflecting the results. The same applies when you hire someone outside Quebec to hold or handle information for you. The federal position on cross-border processing differs, and the data residency article explains it.

Provider contracts: what section 18.3 requires

A business may give personal information to a service provider without the person's consent when it is needed to carry out a mandate or service contract. Section 18.3 then requires the business to put the mandate or contract in writing and to state the measures the provider must take to protect confidentiality, to use the information only for the mandate, and not to keep it after the contract ends.

The provider, in turn, must tell the person in charge without delay of any violation or attempted violation of those confidentiality obligations, and must allow the person in charge to carry out any verification of that confidentiality.

The CAI adds that outsourcing storage does not shift responsibility: the business still keeps the register and gives notices if an incident happens at the provider. A broader supplier questionnaire is in the vendor risk assessment guide.

Editorial suggestion: add a clause requiring the provider to name its hosting country and subcontractors. The Act does not demand it, but you cannot run the section 17 assessment without those facts.

What non-compliance can cost

Under the Quebec Act as shown in the CAI comparison document, amounts in Canadian dollars, failing to take the section 10 measures can lead to an administrative monetary penalty of up to $50,000 for an individual or, for other persons, the greater of $10,000,000 or 2% of worldwide turnover for the previous financial year (section 90.12). It is also a penal offence, with fines of $5,000 to $100,000 for an individual and, for others, $15,000 to $25,000,000 or 4% of worldwide turnover if higher (section 91).

These are ceilings. The Act lists factors for setting the amount, including the nature, gravity, repetition and duration of the breach.

Common questions

This is general information, not legal advice.

Sources