Privacy Officer Under Quebec's Law 25: Role, Duties and How to Appoint One

Since September 22, 2022, every business in Quebec has had to have a person in charge of the protection of personal information, often called the privacy officer. It was one of the first Law 25 obligations to take effect, and one of the easiest to meet, as long as you understand what the role involves day to day. This guide covers who holds the role by default, how to delegate it, what the person actually does, and what a small or mid-sized business needs to do it properly.

For an overview of every obligation, see our Law 25 compliance guide for Quebec businesses.

Who is the privacy officer by default?

Law 25, passed as Bill 64, amended Quebec's Act respecting the protection of personal information in the private sector. Under the amended Act, the person with the highest authority in the business is responsible for ensuring the law is followed and implemented. In most SMBs, that is the president, the owner or the general manager.

In other words, even if you have done nothing, your business already has a privacy officer: you, if you run the company. The real question is not whether to name someone, but whether the person in the role has the time and the support to do it well.

How to delegate the role

The person with the highest authority can delegate the function, in whole or in part, in writing. The delegate can be an employee or someone outside the business.

• An employee: often the head of finance, HR or administration, because those teams already handle a lot of personal information.
• Someone external: for example a compliance consultant. This helps when nobody internally has the time or the background.
• Partial delegation: leadership keeps the role but hands off specific tasks, such as answering access requests or keeping the incident register.

Whatever you choose, put it in writing: a signed letter or resolution stating who is designated, from what date, and for which responsibilities. Keep it with your governance policies and update it whenever the person changes.

Publish the title and contact details on your website

The title and contact information of the person in charge must be published on the business's website. If the business has no website, the information must be made available by other appropriate means.

Most businesses add a section to their privacy policy, or a "Privacy" page linked from the footer. A dedicated address such as privacy@yourcompany.com works well: it stays valid when the person changes, provided someone actually reads it.

What the privacy officer does day to day

The role is more than a name on a website. These are the tasks that come up most often.

Approve governance policies

Since September 2023, businesses must have policies and practices governing personal information: who can access it, how long it is kept, how it is destroyed, and how complaints are handled. The privacy officer approves these policies and makes sure they are followed in practice, not just on paper.

Take part in privacy impact assessments

Also since September 2023, a privacy impact assessment (PIA) is required in certain situations, for example when you acquire, develop or overhaul an information system that handles personal information, or when personal information is sent outside Quebec. The privacy officer takes part in these assessments and makes sure the risks they identify are dealt with before the system goes live.

Handle access and correction requests

Customers, employees and job applicants can ask to see the personal information you hold about them, or to have it corrected. The privacy officer receives these requests, makes sure they are answered within the legal deadlines, and keeps a record of each answer.

Keep the incident register and send notices

A confidentiality incident might be an email with client details sent to the wrong person, a stolen laptop, or a Microsoft 365 account taken over by a fraudster. Every incident must be recorded in a register, and the Commission d'accès à l'information (CAI), Quebec's privacy regulator, can ask for a copy. When an incident presents a risk of serious injury, the CAI and the people affected must be notified.

Build staff awareness

Many incidents start with a human mistake: a file shared too widely, a click on a phishing link, a client list forwarded to a personal address. The privacy officer makes sure staff know the basic rules and know who to tell about an incident, quickly and without fear of blame.

What an SMB actually needs

In a business of 10 to 100 employees, the privacy officer almost always wears another hat. Three things make the difference:

• Protected time: a few hours a month for the inbox, the register and policy follow-up, and more during a new project or an incident.
• Templates: an incident register, a standard reply to access requests, an up-to-date privacy policy. The CAI publishes guidance for businesses.
• An IT partner for the technical side: much of compliance depends on technology, which is rarely the designated person's specialty.

The technical side, in practice

The privacy officer does not need to become a cybersecurity expert, but needs someone who is. These are the technical pieces that support the role:

• Know where the data lives: an inventory of personal information across Microsoft 365, SharePoint, OneDrive, your business applications and your servers.
• Control access: multi-factor authentication on every account, permissions limited to what each person needs, and access logs that are kept.
• Protect devices: encrypted laptops and phones, and the ability to wipe a lost device remotely, for example with Microsoft Intune.
• Be able to restore: tested backups, with copies ransomware cannot change.
• Respond fast: threat monitoring and an incident response plan, so you quickly know what happened and which data was involved. That is exactly what the privacy officer needs to fill in the register and decide whether to notify the CAI.

At Nexxo, this is the part we take on: 24/7 monitoring, Microsoft 365 and Intune management, Veeam backups with immutable copies, managed detection and response (MDR) with Huntress, and critical incidents picked up in under 15 minutes. Our private data compliance service adds gap analysis, policy writing, privacy impact assessments and staff training.

Common mistakes

• Assuming nobody is in charge. By default it is the person with the highest authority. Ignoring the role does not make it go away.
• Delegating verbally. Without a written document, it is hard to show who held the role when an incident happened.
• Publishing an address nobody reads. An abandoned inbox means an access request that never gets answered.
• Keeping a register that is always empty. A register with no entries at all can mean incidents are not being detected, or not reported internally.
• Leaving the person alone with the technology. Without access to logs, backup status and an IT partner, they cannot assess an incident.
• Forgetting the website after someone leaves. Update the written delegation and the published contact details as soon as anything changes.

Checklist

• The person in charge is identified, by default or by delegation.
• Any delegation is written, dated and signed.
• The title and contact details are published on your website.
• A dedicated email address is checked every week.
• Governance policies are adopted and approved.
• A confidentiality incident register exists and is kept up to date.
• A procedure explains when and how to notify the CAI and the people affected.
• A procedure covers access and correction requests.
• New IT projects go through a privacy impact assessment when required.
• Your IT partner can quickly provide logs, backup status and an incident analysis.

What if you don't comply?

The CAI can impose administrative monetary penalties of up to $10 million or 2% of worldwide turnover. The law also provides for penal fines of up to $25 million or 4% of worldwide turnover. Those maximums are for serious cases, but they show the law is meant to be taken seriously. Our Law 25 compliance guide explains them in detail.

FAQ

Does a small business really need a privacy officer?

Yes. The obligation applies to private-sector businesses in Quebec regardless of size. In a small business, the owner or president usually holds the role by default, whether they know it or not.

Can the role be given to someone outside the company?

Yes. The person with the highest authority can delegate the function, in whole or in part, in writing, to an employee or to someone outside the business, such as a compliance consultant.

What has to be published on the website?

The law requires the title and contact information of the person in charge. A dedicated page or a section of your privacy policy, with an email address someone actually monitors, lets the public reach the right person easily.

What counts as a confidentiality incident?

It includes unauthorized access to, use of or disclosure of personal information, or its loss. For example, an email sent to the wrong person or a stolen laptop. Every incident goes in the register, and those presenting a risk of serious injury must be reported to the CAI and the people affected.

How much time does the role take?

For an SMB, a few hours a month is usually enough in normal times: watching the inbox, keeping the register, reviewing policies. Plan for more during a new IT project, a complex access request or an incident.

How does the role connect to cybersecurity?

Closely. Many confidentiality incidents have a technical cause, or a human mistake involving technology. Without multi-factor authentication, backups and monitoring, the privacy officer can neither prevent incidents nor assess them properly.

This article is general information, not legal advice. For a specific situation, consult a legal professional. The CAI also publishes a summary of the main changes introduced by Law 25 (in French).

Check where you stand with Nexxo

Not sure your business is ready? Nexxo offers a free assessment that covers both Law 25 compliance and the technical side: access, backups, devices and incident response. See our private data compliance service, or our private data compliance support in Montreal, with a bilingual team that comes on-site in Montreal, Laval and Longueuil.