Is your company compliant with Québec’s new Law 25?
Since September 22, 2022, Québec has followed Europe’s lead by adopting Law 25, and several provisions will be enacted this month.
What is Law 25?
Québec’s Law 25 is Canada’s most recent and noteworthy privacy legislation. The regulation strengthens and standardizes protecting personal information collected online from Quebecers.
Why does this affect your business?
Most organizations and businesses manage and maintain personal information on web platforms. For example, web forms collect and store sensitive information such as emails, addresses, or phone numbers.
Law 25 requires that every business website have a page dedicated to a personal information policy. All businesses with a website collecting personal information from visitors must create a personal information policy page if they do not already have one. This personal information policy page specifies how the company uses collected data and designates a person responsible for protecting the customers’ personal information. The selected person needs to be a company employee, with their name, title, and contact information included on the personal information policy page.
What happens if there is a data breach?
If your company experiences a data breach, the designated personal information policy person must notify the Commission d’accès à l’information du Québec and everyone who had data compromised during the incident. Your company must also keep a register of confidentiality incidents and send a copy to the Commission upon request.
What should I do?
Tansley’s technical team can assist you in updating your website to comply with Law 25. We can also place the necessary information on your website and ensure that your website has vital security in place, such as double authentication, to prevent a data breach from occurring. Please contact our Chief Technology Officer to learn more about Law 25 elements so that you comply with the new Law 25.
