Quebec. Data localisation / cross-border. Act
Law 25 transfer PIAQuebec Private Sector Act s.17 (as amended by Law 25) - privacy impact assessment for communication of personal information outside Quebec
In force
§1Summary
- Synopsis
Before personal information leaves Quebec (including to other Canadian provinces), the enterprise must assess whether it would receive adequate protection, considering sensitivity, purpose, safeguards and the destination's legal regime. If adequate, the transfer must be governed by a written agreement.
- Key themes
- Unique features
Applies to transfers to other provinces as well as abroad; no government whitelist exists, so each transfer is assessed case by case.
- SaaS relevance
Quebec customers of a SaaS hosted outside Quebec must complete a transfer PIA and sign a compliant agreement with the vendor, so vendors are routinely asked for TIA support material.
§2Obligations
- Extraterritorial
- Yes
- Cross-border transfers
- Case-by-case PIA + written contract
- Maximum penalty
- As per Private Sector Act
§3Dates
- Key dates
- Adopted
- In force
- Transfer rules effective 2023-09-22
§4Text and authority
- Text
- Authoritative text legisquebec.gouv.qc.ca
- Authority
- Commission d'accès à l'information du Québec (CAI)
§5Where it applies
- Domestic law of
- Quebec
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Parallel rule in the public-sector Access Act (s.70.1).