Skip to main content
Review these requirements with your privacy and legal teams when planning a deployment involving Quebec personal information.

​
Governance and privacy assessments

Quebec’s private-sector privacy law, as amended by Law 25, includes governance, transparency, and privacy-impact assessment requirements. Review the assessment needed for a project to acquire, develop, or overhaul an information system or electronic service involving personal information. Involve the responsible privacy officer early. See the CAI assessment guide. Document the AMLOK workflow, purposes, sources, people affected, locations, access, retention, providers, risks, and mitigations. Revisit the assessment when the workflow or data use changes materially.

​
Processing outside Quebec

An assessment is required before relevant communication or entrusted processing outside Quebec, including another Canadian province. The assessment and written agreement must address protection and identified risks. Canada-only hosting does not automatically satisfy Quebec’s transfer requirements. See the CAI use and communication guidance.

​
Exclusively automated decisions

When a decision is based exclusively on automated processing of personal information, the person must be informed no later than communication of the decision. On request, information includes the personal information used, the main reasons, factors and parameters, and the right to correct that information. The person must have an opportunity to make observations to a staff member able to review the decision. These requirements can apply to credit decisions. See the CAI guidance. Identify whether the workflow assists a reviewer or decides without human intervention. Assess how it actually operates, rather than relying on a nominal approval step. Configure notices, explanations, correction, and review accordingly.

​
Deployment record

Record the assessment outcome, approved locations, notices and consent, retention, individual-request ownership, and incident escalation. Preserve the configuration and institutional approval record. Quebec-specific language, consumer, credit-assessment-agent, and sector requirements may also apply. Assess these separately. See hosting and subprocessors and AI and model governance.