Who this applies to
Organizations that collect, use, or hold personal information of people in Quebec.
What to know
- A confidentiality incident covers unauthorized access, use, or disclosure of personal information, and its loss.
- When an incident presents a risk of serious injury, the organization must take reasonable steps to reduce the risk and notify the Commission and the people affected.
- Every incident goes in a register, including those that are not reported, and the register is kept for five years.
- Penalties for violations can be severe, and a person in the organization must be responsible for the protection of personal information.
What to do
- Name the person responsible and publish how to reach them.
- Set up the incident register before an incident happens.
- Get Quebec-qualified legal advice. The rules, and the Commission guidance, change.
This guide is a plain-language summary for general information. It is not legal advice and it does not replace the official source. Requirements change, so check the linked source before you act.