Guide
Law 25: what to do after a privacy incident
In Quebec, unauthorized access to personal information triggers specific obligations. The main steps, and how to reduce the risk ahead of time.
The main obligations
- Take reasonable measures to reduce the risk of harm and prevent recurrence
- Assess whether the incident presents a risk of serious harm
- If so, notify Quebec’s Commission d’accès à l’information (CAI) and affected individuals
- Keep a register of all privacy incidents, even minor ones
Technical response
- Isolate affected systems without erasing traces
- Change passwords and revoke suspicious access
- Preserve logs (firewall, servers, email)
- Identify and fix the cause before restoring
Prevention
A penetration test, configuration review and network segmentation reduce the likelihood and scale of an incident. This guide summarizes general obligations; it isn’t legal advice. Consult the CAI or legal counsel for your situation.
Free tool
Open the calculator Take the cybersecurity self-assessment
Further reading
FAQ
Frequently asked questions
Must a minor incident be reported?
It must be recorded in the register; notifying the CAI and individuals is required when there is a risk of serious harm.
Planning penetration testing?
Describe your situation in a few lines; an engineer will call you back quickly. The site visit and quote are free.
Quote
Request a quote
Free, no obligation. A quick answer from an engineer, in English or French.
- Free site visit and quote
- An engineer, not a salesperson
- 15+ years’ experience, across Quebec
- Hardware stocked on altea.io
Updated 2026-11-05