Trust centers and Quebec's Law 25
Law 25 is the one Canadian privacy law that tells you to publish something on your website. A trust centre is a natural home for it.
Quebec's Law 25 amended the Act respecting the protection of personal information in the private sector. It requires an enterprise to publish detailed information about its governance policies for personal information on its website in clear and simple terms, and it requires a privacy impact assessment before communicating personal information outside Quebec. A Quebec buyer reviewing you will ask about both. A trust centre that publishes your governance summary and your data locations answers the first half and gives the buyer what they need for the second.
What does Law 25 require us to publish?
Section 3.2 of the Act requires the enterprise to publish detailed information about its governance policies and practices on its website, in clear and simple terms. The person in charge of protection of personal information, by default the most senior executive unless delegated in writing, should also be identifiable, and their title and contact details published. Link these from your trust centre if they live elsewhere on your site.
What does a Quebec buyer need from us about transfers?
Section 17 requires an enterprise to conduct a privacy impact assessment before communicating personal information outside Quebec, and to have a written agreement that addresses the assessment's results. If your service stores or processes a Quebec customer's data outside Quebec, including elsewhere in Canada, your customer must assess that. Give them the facts: where data is stored, which subprocessors see it and where they are, and what safeguards apply. Data residency and subprocessor lists set out the wording.
What about confidentiality incidents?
Law 25 requires notifying the Commission d'accès à l'information and affected individuals of a confidentiality incident that presents a risk of serious injury, and keeping a register of incidents. Your customer depends on you to tell them quickly. State your notification commitment on the trust centre.
Should the trust centre be in French?
If you sell into Quebec, publish at least the privacy governance content in French. Quebec's Charter of the French Language sets requirements for commercial publications and contracts, and a French version makes a Quebec reviewer's job easier. Ask counsel what applies to your situation.
Common questions
Does Law 25 apply to a company outside Quebec?
It applies to enterprises carrying on business in Quebec and handling personal information of people in Quebec, which can include companies based elsewhere. Your Quebec customers will apply it to you through their contracts regardless.
Is hosting in Canada enough for a Quebec customer?
Not automatically. Section 17 applies to communicating personal information outside Quebec, which includes other provinces. Your customer still assesses the transfer, though a Canadian location usually makes that assessment simpler.
Get Law 25 content onto your trust centre
In English and French, from providers who know Quebec requirements.
Get matched