A privacy incident logged in a stray email, an access request nobody can confirm is still within its deadline, a breach notice to the affected person drafted in haste without all its required elements: Law 25 is a matter of days and evidence. This application keeps the registers and prepares the steps expected of a business covered by this Quebec law.
Who the application is for
For businesses subject to Quebec's Law 25 on the protection of personal information in the private sector, which must keep an incident register, respond to access requests and designate a person in charge of protecting personal information.
What the application does
- Keeps the register of privacy incidents, with their circumstances, the information involved and the date the business became aware of them.
- Documents processing activities and the designated person in charge of protecting personal information.
- Calculates the response deadline for an access, rectification or portability request, from a timeframe you have entered and sourced, and leaves it blank while that timeframe is missing.
- Refuses to generate a breach notice to the affected person while one of its six required elements is missing, and names it.
- Keeps the privacy impact assessment for the relevant projects, with the dated participation of the person in charge.
- Calculates the date until which an incident must be kept, from the date it became known, and refuses its deletion before that date.
Day to day
- Designate the person in charge of protecting personal information and describe your processing activities.
- As soon as an access request arrives, record its date of receipt and its type: the deadline is calculated on its own, from the timeframe you have entered and sourced.
- If an incident occurs, record its circumstances and the date you became aware of it, then have the designated person assess the risk.
- Produce the notice to the affected person once its six elements are gathered, then mark it as sent: its text can no longer be changed afterwards.
- For a project to acquire, develop or overhaul a system, open the privacy impact assessment as soon as it starts.
What the application does not do
- It does not transmit anything itself to the Commission d'accès à l'information or to the affected person: the Commission offers no automated interface, and each notice is filed by hand on the official form.
- It does not say whether a serious risk of harm exists, nor whether the business is in breach: these assessments remain those of the designated person.
- It does not offer any official privacy assessment questionnaire: the questions provided are a working aid, not a mandatory form.
- It does not replace the advice of the Commission d'accès à l'information or of a qualified Quebec legal adviser: Law 25 and its deadlines can change, and each situation still needs to be validated.
Free and full editions
The free edition already keeps the incident register, the register of processing activities and the file of the designated person in charge. The full edition installs on top without losing anything, and adds access requests with their deadline, controlled breach notices, the privacy impact assessment and the retention alert.
Getting started
First designate the person in charge of protecting personal information, then enter the response deadline applicable to requests with its exact source from the Commission d'accès à l'information: without it, no deadline is calculated.
Going further
To find out whether this application suits your business and how to activate it, compare the plans or write to us.