Quebec Law 25 and storing client files outside Quebec

What changed, and when

Quebec's Law 25 amended the province's private-sector privacy act in stages between 2022 and 2024. The stage that matters here took effect in September 2023: before communicating personal information outside Quebec, an organization must conduct a privacy impact assessment and satisfy itself that the information will receive adequate protection, judged against generally recognized privacy principles.

Read that boundary carefully. It is outside Quebec, not outside Canada. Sending a client file to a processor in Ontario engages the same requirement as sending it to Texas. The assessment is likely to reach a comfortable conclusion faster for the Ontario case, but the obligation to make one is the same.

What the assessment actually involves

The statute asks you to weigh the sensitivity of the information, the purposes it will be used for, the protective measures in place around it, and the legal framework of the place it is going, including whether that framework offers protection comparable to Quebec's.

For a small firm this is a document, not a project. Name the information, name the destination and the provider, describe the safeguards, describe the legal environment, and record the conclusion. It has to exist, it has to be honest, and it has to be revisited when the arrangement changes. A vendor that publishes clear answers about ownership, hosting, subprocessors, and backup location saves you most of the work.

The obligations that travel with it

Law 25 also brought in a confidentiality-incident register, notification to the Commission d'acces a l'information and to affected individuals where an incident presents a risk of serious injury, privacy by default for services offered to the public, and a right to data portability. None of these are triggered by cross-border transfer specifically, but they all become sharper once your files sit with a third party, because an incident on their side is still an incident you have to log and assess.

Penalties under Law 25 are substantial by Canadian standards, which is why it has driven more vendor questions in Quebec than PIPEDA ever did in the rest of the country.

The simplest way to shrink the problem

The assessment obligation attaches to communicating the information outside Quebec. Every arrangement that keeps client documents inside the province, or that at least keeps them with a Canadian entity under Canadian law, narrows what you have to assess and what you have to explain when a client asks.

That is not a compliance shortcut and nobody should sell it as one: an in-province arrangement still needs safeguards, a retention schedule, and an incident plan. But it removes one recurring piece of paperwork and one recurring conversation, and for a firm without a privacy officer that is worth something.

A note on French

Quebec's language rules are a separate regime from its privacy rules, but they land on the same desk. If you serve Quebec clients, check what your tools present to them, and remember that a client-facing upload page is client-facing communication.