A client shows me the contract for a new cloud payroll application. Price guaranteed until Friday. I ask one question: where will your employees’ files be hosted?
Silence. Then: “In Canada, I think.”
That answer settles nothing. Quebec’s privacy law (Loi 25) does not say “outside Canada.” It says “outside Quebec.” A data centre in Toronto is in scope.
In short: before certain projects, the law requires a privacy impact assessment (PIA, or EFVP in French). It is done before signature, and project by project, not once for the whole company.
A quick reminder: what is a PIA?
The Commission d’accès à l’information (CAI) describes it as a preventive process that evolves, starting at the beginning of a project that touches personal information. In practice, it is a written exercise. What do we collect? Where does it go? Who touches it? What can go wrong, and what do we do to reduce that risk?
The CAI guide lists several situations where it is mandatory in the private sector. Two of them affect almost every SMB: sections 3.3 and 17 of the Act respecting the protection of personal information in the private sector, in force since September 2023. A third, communication without consent for research purposes (section 21), is rare among SMBs.
Situation 1: you buy, build, or rebuild a system
Here is what section 3.3 says:
“Any person carrying on an enterprise must conduct an assessment of the privacy factors of any project to acquire, develop or overhaul an information system or electronic service delivery involving the collection, use, communication, keeping or destruction of personal information.”
The word “project” is broad. A new CRM, a migration to Microsoft 365, a client portal, a payroll platform, a conversational agent on your site, or an online appointment form all fall under this definition as soon as they touch personal information.
The section adds three points I rarely see respected.
First, you must consult your privacy officer at the start of the project. Not at the end, for a signature of convenience.
Next, the system must be able to give a person the computerized personal information that the person provided, in a structured and commonly used technological format. That is a concrete buying criterion. Ask the vendor to show you how it exports one person’s file.
Finally, the assessment must be proportionate to the sensitivity of the information, the purposes for which it is used, its quantity, its distribution, and its medium. An internal survey tool does not call for the same work as a platform that holds social insurance numbers.
Situation 2: information leaves Quebec
Section 17 begins like this:
“Before communicating personal information outside Quebec, a person carrying on an enterprise must conduct an assessment of the privacy factors.”
It asks you to consider at least four elements: the sensitivity of the information, the purposes for which it is used, the protection measures it would benefit from (including contractual measures), and the legal framework of the State where it would be communicated.
This is not a suggestion: the communication may take place if the assessment shows that the information would benefit from adequate protection. It must also be the subject of a written agreement that takes into account the results of the assessment and the measures agreed to reduce the risks. The assessment gives the go-ahead, not the vendor.
The same section applies when you entrust a person or body outside Quebec with collecting, using, communicating, or keeping information on your behalf. Your cloud software hosted elsewhere is a typical case, even if the vendor is Canadian.
What a PIA is not
It is not a risk analysis of the whole company. If you have done your analysis under ISO 27005, you already have a good part of the vocabulary (sensitivity, consequences, likelihood). The risk analysis covers the whole organization, once a year. The PIA covers one project, before it launches. Risks found in one can feed the register of the other.
It is not a prohibition. A PIA does not stop you from using a foreign vendor. It requires you to document why the protection is adequate, then to write into the contract what you found.
It is not a forty-page report either. In my view, for a simple project, a few well-filled pages are worth much more than a CAI template filled out in full out of obligation.
The six steps in the CAI guide
The CAI guide (2024 version) proposes a six-step process:
- Determine whether an assessment is required.
- Define the project and the object of the assessment.
- Prepare the assessment: inventory of the information, its path, its scope, applicable obligations.
- Assess the factors and choose the strategies and measures.
- Write a report.
- Keep the assessment up to date.
The report describes the project, the legal situation that prompts the assessment, the roles, the inventory of the information, its path, the risks, the measures, an action plan with a schedule and owners, then approval by the company’s decision-makers (names, titles, signatures, and date).
Example: a payroll platform in an SMB of 35 employees
Here is what the core of a proportionate PIA can look like. The company is fictional.
| Question | What we note |
|---|---|
| Information involved | Name, address, social insurance number, banking details, salary, absences. Current and former employees. High sensitivity |
| Path | Entered by the controller, vendor platform, bank deposit, export to accounting |
| Hosting | Data centre in Ontario. Backup copy in another country, to be confirmed in writing |
| Vendor access | Technical support can view the files from abroad when needed |
| Subcontractors | Two, named in the contract |
| Retention | Seven years after the employee leaves. Destruction confirmed in writing |
| Export of one file | Tested in a demo. Structured format obtained |
| Incident at the vendor | Notice period set out in writing in the contract |
| Decision | Sign, with an amendment on hosting and incident notices. Residual risk accepted by the president: support access from abroad, with logging. Review in 12 months |
That last line does not look like a yes or a no. The vendor did not offer hosting exclusively in Quebec, and the company did not drop the project either. It made a decision, wrote it down, and named the person who owns it.
The conflict with the calendar
I know the objection from the sales director or the controller. The vendor guarantees the price until Friday, and the team wants to roll the tool out at the start of the month.
The PIA is done before signature precisely because, afterward, all that remains is to ask for changes to a signed contract. I do not have a perfect answer to this conflict between speed and rigor. What I suggest at a minimum: ask the vendor to extend the offer by a few days. If they refuse, that is already information about how they will treat your requests later.
In practice, before you sign
- Name the person who leads the assessment, and consult the privacy officer at the start of the project.
- List the information involved and the categories of people concerned (employees, customers, applicants).
- Get in writing the hosting location, the place from which technical support accesses the data, the list of subcontractors, the retention period, and the destruction procedure.
- Have them export one person’s file in front of you.
- Assess against the five factors in section 3.3 (sensitivity, purpose, quantity, distribution, medium) and note the risks and the measures.
- If information leaves Quebec, have your findings carried into a written agreement.
- Have the company’s decision-makers approve the report, with the date.
- Schedule a review at each important change, such as a new subcontractor, a change of hosting, or a new artificial-intelligence feature added by the vendor.
A few traps
Watch for a PIA written after the fact. If it is dated before the signature but written after, you have created a second problem. An assessment that is late and honest, with its real date, is better than a backdated one.
The vendor’s security report is not your PIA. It describes their system, not your project or your information. The CAI guide places responsibility for carrying out the assessment on the organization that holds the information. I can ask the questions and support the process, but proper compliance remains the company’s.
“Hosted in Canada” does not settle the question. Remember the text of section 17: Quebec is what counts.
A PIA done in 2024 for a tool that changed subcontractor in 2026 is an outdated PIA. The guide speaks of an assessment that must evolve with the project.
What I do not know
I do not know how far the CAI actually reviews these reports in practice. As far as I know, it does not publish statistics on PIAs it has checked. Its 2024-2025 annual report only mentions that in May 2024 it improved its guide and its report template.
The question can arrive through other doors, though. An ISO 27001 auditor, or a customer sending a security questionnaire, may ask to see the assessments of recent projects. That is where the absence of a report shows.
In short, a PIA is not one more document to file. It is the question “where does the information go?” asked before signature rather than after. What was the last tool your company adopted? Do you know today where its information is hosted?
Preparing a signature? Let’s talk.
References
- Act respecting the protection of personal information in the private sector, sections 3.3 and 17 (LégisQuébec)
- Commission d’accès à l’information, Conducting a privacy impact assessment (guide, 2024, in French)
- Commission d’accès à l’information, Annual activity and management report 2024-2025 (in French)