What is Law 25?

For all businesses operating in Quebec, as well as any business doing business with Québec enterprises, Bill 25 imposes new requirements. This legislation modernizes privacy legislation. Originally called Bill 64, Law 25 makes significant changes in 2023. It will be fully in force by 2024.

It's objective? Protect the integrity of the data and ensure the security of all operations involving personal information, in order to counter the fraudulent use of unsecured information.

 What do you have to do now to enforce the law? 

As of September 22, 2022, an employee responsible for the protection of personal information must be appointed by the company to ensure that all the requirements of the act are applied.

The responsible employee must ensure the implementation of records management practices, physical infrastructure protection and IT security measures to protect not only employee data but also those of clients and business partners.

And in the future? 

As of September 2023, Law 25 will require these responsible employees for personal information to implement a corporate data governance policy. They are responsible for implementing staff training to ensure that the new policies are properly applied.

They must also ensure that a privacy impact assessment is conducted for all personal data processed in their company. The purpose of this assessment is to assign a level of risk each time data is processed by the company.

It should also be noted that these personal data governance policies must be made available to customers via a website.

MPEX and Law 25! 

The law will come into force very soon! It is, therefore, necessary to take all the measures now, to meet the new requirements.

At MPEX we have many policies in place to comply with Law 25. We seek to protect our employees, as well as all our customers and partners. Personal information is used only for specific and justifiable purposes.

For more information regarding Law 25, click HERE.