Confidentiality incident (Loi 25)

One question I ask in an audit: “Show me your confidentiality-incident register.”

It is not a trap. The register has been a legal obligation in Quebec since 2022, and it covers every incident, not only those that require notice to the Commission d’accès à l’information (CAI). Still, it is the document most SMBs discover on the day they need it.

The day an employee sends the wrong attachment, or ransomware encrypts your server, you will not have time to read the statute. The decisions have to be made already. Here is the plan.

What a confidentiality incident is

According to the CAI, it is any access to, use of, or communication of personal information not authorized by the law, and any loss of personal information or other breach of its protection.

That goes well beyond a cyberattack. An email sent to the wrong customer, an employee who opens a colleague’s file out of curiosity, a laptop stolen from a car: each of those is an incident.

The scale shows up in the CAI’s figures. In 2024-2025, it received 514 incident notices, up 16% in one year. 80% came from the private sector. The main causes: 160 cyberattacks, 110 cases of human error, and 106 ransomware events. One notice can list more than one cause. These figures therefore do not add up. Human error weighs almost as much as the cyberattack. No firewall fixes it.

What the law asks you to do

When you have reason to believe an incident has occurred, four duties follow one another.

Reduce the risks and keep it from happening again. You must take reasonable measures, right away.
Assess the risk of serious injury. That judgment decides what comes next.
Notify the CAI and the people concerned if the risk is serious. With diligence.
Enter the incident in the register, in every case. Serious or not.

Point 4 is the one people forget. An incident judged to carry no risk of serious injury does not have to be reported to the CAI, but it must be recorded, with the analysis that supports that conclusion.

How to assess: the grid

The law asks you to consider three criteria: the sensitivity of the information, the anticipated consequences of its use, and the probability that it will be used to cause injury.

Criterion	Lower risk	Higher risk
Sensitivity	Name and professional email	Social insurance number, financial or health data, HR file, identifiers and passwords
Consequences	Minor inconvenience, nothing a fraudster can gain	Identity theft, fraud, harm to reputation, discrimination, and harassment
Probability of injurious use	A known, reliable recipient who confirms in writing that the message was deleted; a lost device that is encrypted	Exfiltration by an attacker, publication online, an unknown recipient, data readable in clear text

Three examples to calibrate your judgment. The conclusion always depends on the precise facts.

An invoice sent to the wrong customer. The recipient is identified, and deletion is confirmed in writing. Probably no risk of serious injury. Register only, with the analysis and the recipient’s confirmation attached.
A stolen laptop with an encrypted disk. The data cannot be read without the key. The probability of use is low, provided you can prove the encryption. Register, and keep the proof of encryption.
Ransomware with exfiltration of employee files. Sensitive data in a criminal’s hands. Risk of serious injury. Notice to the CAI and to the people concerned.

If you hesitate, that is already a signal. Write down why you conclude there is no risk of serious injury: that is the record you will be asked for.

When to “call” the CAI

First, you do not call. You file a written notice using the CAI’s online form. Choose “Entreprise ou organisation privée” (private-sector business), then “La déclaration d’un incident de confidentialité” (report a confidentiality incident). For a general question, the “Nous joindre” section of the CAI website gives the contact details and opening hours.

Then, when? As soon as your assessment concludes there is a risk of serious injury. Quebec law sets no numbered deadline (no “72 hours,” as in the European GDPR). The requirement is to act with diligence. In practice, that means you cannot wait until you have every answer. If you learn something new after sending the notice, you must send it to the CAI.

One concrete consequence: note the exact time and date you became aware of the incident. That date is the starting point for judging your diligence, and for keeping the register.

If you do not notify when you were required to, the CAI can order you to do so.

Notifying the people concerned

Notice to the people concerned is also given as soon as possible. It must include:

a description of the information involved (or the reason you cannot provide one);
the circumstances of the incident;
the date or the approximate period;
the measures taken to reduce the risks;
the measures you suggest the person take to protect themselves;
a contact person to reach.

Three exceptions allow a public notice instead of an individual one: if the notice could cause greater injury, if sending it would be excessively difficult, or if you do not have the person’s contact details. A public notice can also accompany the individual notice, to reduce the risk faster. It replaces the individual notice only in those three cases. These exceptions are not a way out. They are documented too.

The law provides a separate case: no notice to the person if giving it could hinder an investigation into a crime or an offence. That is not a decision to make alone.

The register: the document you will be asked for first

Every incident goes in it. Keep it for at least five years after the date or period you became aware of the incident. Keep the register up to date as well. The CAI can ask you for a copy.

Here is a column model. The first eight reflect the required content. The others are additions I recommend for rigor. If you cannot describe the information involved, write down why.

#	Column	Why
1	Description of the information involved	Required
2	Circumstances of the incident	Required
3	Date or period of the incident	Required
4	Date you became aware	Required
5	Number of people concerned	Required
6	Analysis of the risk of serious injury (3 criteria and the conclusion)	Required
7	Dates notices were sent (CAI, people, public notice and its reason)	Required
8	Corrective measures taken	Required
9	Incident number	Traceability
10	Category (access, use, communication, loss)	Internal statistics
11	Root cause	Avoid a repeat
12	File owner and closing date	Follow-up
13	Supporting records (deletion confirmation, proof of encryption)	Defend your conclusion

Why this is a business risk, not only a legal one

The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover for the preceding fiscal year. On the penal side, fines for a business can reach $25 million or 4% of worldwide turnover for the preceding fiscal year. In both cases, the higher amount applies.

These ceilings are rarely reached, of course. But they set the frame. The CAI takes into account the gravity, the number of people affected, and whether the breach was intentional. A company that has a plan, an up-to-date register, and a record of exercises is in a very different position from one that improvises.

In January 2026 the CAI also published a prevention guide, with a seven-step cycle: obligations, an inventory of personal information, risks, measures, deployment, measuring whether they work, and review. Its message: strong IT security is not, on its own, enough to protect personal information. Governance, limiting collection, and transparency count too.

The plan before the incident

1. A named officer, with a deputy. The law provides for a person in charge of the protection of personal information. You must consult that person when you assess the risk. They must be reachable at all times. The deputy must know they take over.

2. An internal reporting channel with no punishment. Human error accounts for more than 100 notices a year in the CAI’s files. If your employees are afraid to report, you will learn too late. Define “incident” in everyday language (“I sent something to the wrong person,” “I lost my phone”) and say where to report it.

3. Contacts prepared in advance. Counsel, an incident-response firm, your IT provider, and your cyber insurer. Check whether the policy requires notice before you incur costs.

4. Contract clauses with your subcontractors. A vendor hosting your data can suffer an incident and not tell you. You remain responsible for the register and the notices, even if the information sits with them. Require, by contract, prompt notice and help with the inquiry. If a signature is close, the PIA is the other document to have ready.

5. Templates ready. The register, a draft notice to the CAI, and a draft notice to the people concerned. Writing them under stress is the surest way to forget an element.

6. One exercise a year. One hour of simulation (“a laptop is stolen, what do we do?”) is enough to discover that nobody knows who decides. Keep the minutes: they are evidence of diligence.

The first 24 hours

Contain: cut off access, recover the message, isolate the machine.
Preserve the evidence: do not erase anything and do not reinstall anything before you have kept the logs.
Record: the time you became aware, and who did what.
Assess: the grid above, with your privacy officer.
Decide: whether to notify. Write down why.

In short, the time to read the statute is not the time of the incident. The plan, the register, and the assessment grid can be prepared this week. The day someone asks for them, they stand on their own. Does your register already exist? Do you know who keeps it?

Want to know where you stand on this? Let’s talk.

Confidentiality incident (Loi 25): the plan before the incident