Quebec's Act to modernize legislative provisions as regards the protection of personal information, better known as Law 25, has profoundly changed the obligations of Quebec businesses and public bodies. Phased in between 2022 and 2024, its provisions require every organization that holds personal information to put in place security measures that are "reasonable" given its sensitivity.
The word "reasonable" often worries executives because it comes with no precise list. In practice, it refers to recognized cybersecurity best practices. Here are seven measures that, in our experience, form the foundation of a defensible posture.
1. Know where your personal information is
You can only protect what you know. An inventory of personal information — what data, in which systems, accessible by whom, kept for how long — is the first step. The same inventory helps you apply the retention and destruction rules set out in the law.
2. Turn on multi-factor authentication wherever possible
Compromised credentials remain one of the main entry points for attackers. Multi-factor authentication on email, remote access, cloud applications and administrator accounts greatly reduces this risk at a modest cost.
3. Apply the principle of least privilege
Each employee should only access the information needed for their job. Reviewing access rights at least once a year, promptly removing the access of departing employees and separating administrator accounts from everyday accounts are simple, effective steps.
4. Keep systems up to date and monitor endpoints
Known, unpatched vulnerabilities remain a favourite way in. A patch management process, combined with an endpoint detection and response solution on workstations and servers, makes it possible to spot and contain an attack before it spreads.
5. Prepare to handle confidentiality incidents
Law 25 requires organizations to keep a register of confidentiality incidents and, when an incident presents a risk of serious injury, to notify the Commission d'accès à l'information and the people concerned. That requires a written procedure, defined roles and regular exercises.
Good to know
Administrative monetary penalties under Law 25 can reach $10 million or 2% of worldwide turnover for businesses. Beyond the penalties, your clients' trust is at stake.
6. Conduct privacy impact assessments
Any project to acquire, develop or overhaul a system involving personal information must undergo a privacy impact assessment. Done early in the project, this assessment lets you design security in from the start rather than fix it afterwards.
7. Train and raise awareness among employees
Most incidents have a human component: a phishing email, a reused password, a document sent to the wrong recipient. Short, regular training sessions, complemented by phishing simulations, turn your employees into your first line of defence.
Where to start?
For most organizations, a maturity assessment against a recognized framework such as NIST CSF 2.0 is the best starting point. It provides an objective picture of the situation and produces a prioritized roadmap that management can follow and present to the board.
Compliance is not a one-time project but an ongoing process. Organizations that treat it as a lever of trust rather than a constraint gain a lasting advantage.