Quebec Law 25 (formerly Bill 64) — Loi 25

Loi 25 — what makes it strictest in North America

Loi 25 imposes obligations beyond PIPEDA in several areas: mandatory Privacy Officer designation, Privacy Impact Assessments before deploying new technologies that process personal information, mandatory breach reporting to CAI within prescribed timeframes, formalised right of erasure (data portability + right to be forgotten), explicit consent requirements stronger than PIPEDA, and penalties up to CAD 25M or 4% of global revenue. For ITAD specifically, the Privacy Impact Assessment requirement applies to selecting a new ITAD vendor — an existing vendor relationship is grandfathered but a new engagement triggers PIA.

Privacy Impact Assessment for ITAD vendor selection

Article 3.3 of Loi 25 requires a Privacy Impact Assessment for projects that involve the acquisition or modification of an information system that processes personal information. Selecting a new ITAD vendor is in scope. Maxicom provides a pre-prepared PIA documentation pack to support customer PIA processes — vendor due-diligence summary, data-flow map, security controls inventory, sub-processor list, breach-history disclosure, certificate-format samples.

Breach reporting to CAI

Loi 25 mandates breach reporting to the Commission d'accès à l'information for breaches involving personal information that present a risk of serious injury. ITAD-relevant breaches in scope. Maxicom incident-response playbook coordinates with the customer's CAI reporting workflow within the prescribed timeframe.

Bill 96 / Charter of the French Language — operational implications

Quebec's Charter of the French Language (Loi 14, formerly Bill 96) requires French-language documentation for commercial activities in Quebec. Maxicom's Quebec engagements provide French-language manifests, French-language certificates of destruction, French-language quarterly reports. The technical content (NIST SP 800-88 Rev. 2, IEEE 2883-2022) is referenced in original English with French explanation; the legal-effect content is in French.

Quebec FRFI engagement profile

Major Quebec FRFIs (National Bank, Desjardins, Industrielle Alliance) operate to Loi 25 + OSFI B-13 simultaneously. Maxicom certificate format satisfies both. Quebec-French native commercial-translator review of customer-facing materials is recommended for engagements at this tier.