Law 25 and buying software: what a Quebec business should ask its developer

Bitsoven is a software studio, not a law firm. This article is general information, not legal advice. For your own situation, speak to a lawyer or consult the Commission d’accès à l’information du Québec.

Why a software purchase is a privacy decision

Law 25 is the common name for the reforms to Quebec’s private-sector privacy law that took effect in phases between 2022 and 2024. If your software handles personal information about people in Quebec, whether customers, employees or patients, choices made while it is being built can have legal consequences for your business, not only for the developer.

What the law asks of businesses, in short

In broad terms, businesses are expected to name a person responsible for protecting personal information, to report certain confidentiality incidents, to explain clearly what they collect and why, and to obtain meaningful consent. They are also expected to carry out a privacy impact assessment in certain situations, including before personal information is transferred outside Quebec. The details and exceptions matter, so treat this as a map of the topic and not a checklist.

Questions to ask your developer

1. Where will the data be stored and processed? Include backups and every third-party service involved. You cannot assess a transfer outside Quebec if you do not know where the data goes.
2. Which outside services receive personal information? Analytics, email delivery, payments and AI tools are common ones. Each is a place your customers’ data may travel.
3. Who can access production data, and how is that access recorded and removed? Access should be limited, logged and revoked when someone leaves the project.
4. How are incidents detected, and how quickly will you be told? A confidentiality incident is much harder to handle if you hear about it days later.
5. Can the software export or delete one person’s data on request? It is far cheaper to build this in than to add it later.
6. Can the interface and documentation be in French? Quebec’s French-language rules apply to many commercial products. Ask a lawyer what applies to yours.

What we do on our side

We keep data in Canada where we can, we favour open-source tools that can be hosted where you choose so that you know where information goes, and we write the answers to the questions above into the project plan. We do not certify legal compliance. That needs a review by your own advisers, and we are glad to work with them.

If you are planning a project that handles personal information, tell us about it and we will include these questions in the written plan.