Quebec Law 25 and software projects: what must your portal or app plan for?
A client portal gathers names, documents, sometimes secrets. Before the first screen is drawn, the law asks a few simple questions.
6 min readIn Quebec, any project that creates or rebuilds a system handling personal information, such as a client portal or an app, requires a privacy impact assessment (PIA). The project must also plan for privacy by default, limited access, security, retention and, if data leaves Quebec, an assessment of the transfer.
This article is for information only and is not legal advice. For your situation, consult a lawyer or Quebec’s Commission d’accès à l’information.
A client portal often brings together a business’s most sensitive information: names, addresses, documents, sometimes health or financial details. Law 25 doesn’t forbid it; it asks you to think about it before building. That’s what we do for every client portal and every web app.
What a PIA really asks
A privacy impact assessment is a document that answers a few simple questions before development: what information will the system collect, why, who will have access, where will it be stored, for how long, and what risks does that create for the people concerned.
It’s required for any project to acquire, develop or overhaul an information system that handles personal information. It’s proportionate: a simple appointment list doesn’t call for the same analysis as a medical file.
Seven precautions, from the first sketch
| Requirement | What it changes in the portal or app |
|---|---|
| Privacy by default | The most protective settings are on from the start |
| Limited collection | The system asks only for what it needs |
| Role-based access | Each person sees only what concerns them |
| Security | Personal accounts, encrypted connections, backups |
| Retention and destruction | A set period, then real deletion |
| Data outside Quebec | An assessment before any transfer, including to a host |
| Portability | Being able to give people their information in a common format |
Keeping track of every door opened
Keeping track of who viewed or changed what isn’t always required word for word, but it’s often the best way to demonstrate a system’s security, and to understand an incident if one occurs. In a portal holding sensitive information, we plan for it from the start.
Where the data sleeps
The law doesn’t require data to be hosted in Quebec. But if it’s stored or processed elsewhere, the business must first assess whether it will be adequately protected there. Choosing Canadian hosting often simplifies that assessment, and reassures clients.
The house and the craftsman
The business remains responsible for its clients’ information. The provider that builds and hosts the system acts on its behalf: it must do so under written rules, and the business’s privacy officer should be involved from the start.
FAQ
Does a small project need a PIA? Yes, as soon as the system handles personal information, but it can be short if the information isn’t very sensitive.
Who writes the PIA? The business is responsible for it. The provider can prepare and document it with them; we do so for every project concerned.
Does a PIA delay the project? Hardly, if done at the start. Mostly, it avoids fixing a finished system after the fact.
What does a business risk? The Commission d’accès à l’information can impose penalties of up to $10 million or 2% of worldwide turnover.
A well-designed platform protects your clients before they even notice. Tell us what yours needs to keep safe.