Most companies in Quebec treat Law 25 as a website problem. Cookie banner, privacy policy, done. Nobody asked HR.
Wrong department. The biggest pile of personal information in a 50 to 500 person company sits in employee files, payroll, the applicant tracking system and a folder of resumes nobody has opened since 2021.
Quebec Bill 64 became Law 25, and it is fully in force
Bill 64 was the bill number. Assented to in September 2021, it became Law 25, the act modernizing Quebec's privacy legislation. The Commission d'accès à l'information dates each phase. No grace period is left.
Your privacy officer is already appointed
Any person carrying on an enterprise is responsible for the personal information they hold, and the function falls to the highest authority by default: the CEO, the general manager. It can be delegated, in whole or in part, but only in writing. You delegate the work, not the risk.
Three things to publish, not one
The policy is required as soon as you collect personal information by technological means: an online application form, an HRIS.
Quebec privacy law covers your employee data
No size threshold, no employment carve-out. Run the inventory once: employee files, performance reviews, disciplinary records, SIN, banking details, medical notes, psychometric results, interview notes, unsuccessful applications, skills matrix data, pay equity records, exit interview transcripts.
Useful is not the test. The regulator states that necessity goes beyond simple usefulness, and that you must show the person concerned that the information is necessary. Without that, the right to privacy wins and the collection cannot go ahead. Date of birth on an application form: necessary for what, at screening?
Once the purpose is fulfilled, securely destroy or anonymize the information, unless a law sets a retention period. A box of 300 rejected resumes is not a talent pool.
The incident register, and the 72-hour myth
The 72-hour clock is GDPR, not Quebec. When an incident presents a risk of serious injury, you must act promptly to notify the regulator and the people concerned. No fixed number of hours, which is harder: the delay gets judged after the fact.
An incident is unauthorized access, unauthorized use or disclosure, loss, or any other breach of protection. The payroll spreadsheet emailed to the wrong Marie qualifies.
The register is broader than the reporting duty. It holds every incident, including those with no risk of serious injury, for at least five years from the date you became aware, and the regulator can ask for a copy. Each entry: the information involved, the circumstances, both dates, the number of people affected, the reasoning on serious injury, the notices sent, the security measures taken.
Thirty days, and the request lands on a Friday
Access, rectification and, since September 2024, portability requests are answered within 30 days, counted from the request, not from the day someone picks it up. Portability means computerized personal information collected from the person, in a structured, commonly used technological format. In HR: the employee who just got a written warning.
What to fix this quarter
- Put the delegation in writing, signed and dated.
- Publish the title and contact details on a role inbox.
- Map where HR data lives, spreadsheets included.
- Set and enforce a retention period for unsuccessful applications.
- Open the incident register now, even if empty.
What non-compliance costs
Two tiers of penalty:
For a 200-person employer, the real exposure is not the fine. It is a complaint from someone who left on bad terms, an investigation, and no register, no policy, no named officer. At Inlead RH (inleadrh.ca), that is almost always how this arrives.
Start by knowing what you hold. The HR self-assessment and the other free tools take fifteen minutes.
