A customer record in your accounting software, an employee file in a shared folder, an identity document attached to an email: personal information rarely stays in one place. If your business has no internal IT team, knowing where those records live and who can open them is a useful place to start.
Québec’s Law 25 (Loi 25) modernized privacy legislation, including the rules for the private sector, with obligations taking effect in stages between 2022 and 2024. This article offers practical IT guidance, not legal advice. Consult a lawyer or resources from the Commission d’accès à l’information (CAI) to understand the obligations that apply to your business.
Assign responsibility and map your information
By default, the person with the highest authority in the business is responsible for protecting personal information. That role can be delegated in writing. The responsible person’s title and contact details must be published on the business’s website. Check that the information is current and easy to find.
Next, build a working inventory of the places where personal information is stored. A simple document is enough to begin. Review:
- Microsoft 365, including email, OneDrive and SharePoint;
- your customer relationship management software, often called a CRM;
- accounting, payroll and human resources systems;
- shared drives, individual computers and removable storage;
- scanned paper records, attachments and exported lists.
For each location, record what information it holds, why the business uses it, who looks after it and who has access. Include personal accounts used for work, if any. Ask staff about their daily routines: the spreadsheet downloaded for a recurring task is easy to miss when reviewing only the main software.
Match access to the work people do
Someone who prepares customer estimates may need contact details without needing access to payroll. Least privilege means giving people only the access they need for their work. Review permissions by job function, then check exceptions granted for temporary assignments or previous roles.
Enable multi-factor authentication wherever your tools support it. This adds a verification step beyond a password, such as approval through an app on a mobile phone. Pay particular attention to email, remote access and accounts that can change system settings.
- Use an individual account for each employee wherever possible.
- Identify shared accounts and plan how to replace them.
- Remove access promptly when someone leaves.
- Review permissions when someone changes roles.
Create a departure checklist that covers active sessions, devices and outside applications as well as email. Closing one account does not necessarily close the others. Assign someone to confirm completion so the task does not get lost between the office manager and the IT provider.
Prepare an incident register and response plan
A confidentiality incident could involve a lost laptop, an email sent to the wrong person or unauthorized access to a folder. Incidents involving personal information must be recorded in a register. Those presenting a risk of serious injury must be reported to the CAI and the affected individuals.
Write a short response plan before an incident happens. Identify who receives reports, who coordinates the technical response, who maintains the register and who makes communication decisions with appropriate advice. Make the contact list available if the usual email system becomes unavailable.
Record what is known about each incident: when it was discovered, the systems involved, the information affected, the people potentially concerned and the steps taken. Separate confirmed facts from questions still under investigation.
Assessing the risk of serious injury calls for a documented review by the designated privacy lead, with legal advice as needed. A technical alert alone cannot settle that question. Restrict access to the register, too, because its contents may include personal information.
Set a retention schedule and dispose of records securely
Keeping every record indefinitely makes it harder to manage and protect personal information. The general principle is to keep it only as long as needed, then destroy or anonymize it under the applicable rules. Anonymization aims to prevent people from being identified; simply removing names is not necessarily enough.
Build a retention schedule by record category with the people responsible for the business processes and your advisors. For each category, specify when the retention period begins, how long it lasts, any exceptions and the disposal method. Have relevant retention requirements checked before starting a cleanup.
Apply the schedule to business applications, email and exported copies. Decide who will check that scheduled deletion actually happens rather than assuming a setting takes care of everything.
Include retired equipment in the process. Before selling, donating or recycling an old computer or drive, arrange secure erasure suitable for the storage device or appropriate physical destruction. Moving files to the recycle bin is not a reliable disposal method.
Protect backups and plan when they expire
Backups can hold the same personal information as your working systems. Include them in the inventory and retention policy. Confirm which systems are backed up, where the copies are stored and who can view or restore them.
Encryption makes information unreadable without the appropriate key. Check that backup data is encrypted both during transfer and while stored. Protect the management accounts and encryption keys, and limit who can delete backup copies.
Schedule restore tests to check that the information can actually be recovered. A successful backup notification does not, by itself, establish that a usable recovery is possible.
Align backup retention with your policy while accounting for the service’s capabilities. Document how older copies expire and how a recovery will avoid putting previously deleted information back into ongoing use. If individual records cannot be removed from an existing backup, make that limitation visible and have the approach reviewed with your advisors.
Review suppliers before committing to a service
Using cloud software places some information handling in a supplier’s hands. Ask where data will be hosted and where it can be accessed from, including by support staff. A product name or a Canadian sales office does not answer those questions.
Have the contract reviewed for practical details, including:
- confidentiality commitments and access by subcontractors;
- how the supplier will notify you of an incident;
- how you can retrieve your information when the contract ends;
- what happens to remaining data and backup copies afterward.
Privacy impact assessments are required in some circumstances, including certain projects involving personal information and certain transfers outside Québec. An assessment examines how a project affects privacy and what safeguards it needs. Have the requirements checked before purchasing software or starting a migration, while there is still room to change the plan. Keep the supplier’s answers with your project records.
Make the process understandable for employees
Staff need clear instructions they can use during an ordinary workday. Explain where records belong, how to share a document and whom to contact after a mistake. Give employees a reporting option that still works if they cannot access their email.
Cover phishing, unusual requests for information and checking recipients before sending sensitive material. Reviewing a suspicious message together can be a useful exercise. Encourage early reporting without blaming someone for raising a concern or admitting an error.
Introduce these practices during onboarding and revisit them when tools or responsibilities change. Give each item in this checklist an owner and a next action. At Evolute I.T., we help clients with the technical side of Loi 25, including inventories, access, backups and incident procedures, working alongside their legal advisors.
Start with a clear picture of your information, then address gaps and keep the work current. This checklist is practical IT guidance, not legal advice or a guarantee of compliance. Consult a lawyer or CAI resources for your specific obligations.
For help organizing that work, explore our managed IT services and consulting services, or contact us to discuss your situation.
