Québec’s Law 25 and AI: what SMBs should know

Automated decisions

Under section 12.1 of the Act, a business that uses personal information to render a decision based exclusively on automated processing must inform the person concerned no later than when it informs them of the decision. On request, it must also tell them which personal information was used, the reasons and principal factors behind the decision, and their right to have the information corrected. The person must be given the opportunity to submit observations to a staff member who can review the decision.

In our projects, AI prepares and suggests; someone on your team decides. That design choice is also good management practice.

Security and incidents

The Act requires appropriate security measures to protect personal information, and reporting to the CAI and the people concerned any confidentiality incident that presents a risk of serious injury. Administrative monetary penalties are provided for failures.

Our approach

We limit AI access to the data needed, with secured connections, and we document which data is used and why. This helps you answer questions from customers, employees and your legal advisor.

Official sources

For the exact text and full obligations, refer to the official sources:

• LegisQuébec — Act respecting the protection of personal information in the private sector (P-39.1) ↗
• Commission d’accès à l’information — English information ↗

Frequently asked questions