Law 25 and artificial intelligence: what a firm must do
As soon as an AI tool processes your clients' personal information, Québec's privacy law applies. Here are the obligations that matter, section by section.
Key points
- Adopting an AI tool that processes personal information requires a privacy impact assessment (PIA) from the start of the project (s. 3.3).
- Sending information outside Québec, even elsewhere in Canada, requires a prior PIA and a written agreement (s. 17).
- A provider that processes the information for you must be bound by a written contract (s. 18.3).
- Masking names reduces the risk, but only information anonymized irreversibly stops being personal information (s. 23).
- Administrative monetary penalties can reach $10,000,000 or 2% of worldwide turnover.
Who is covered
Québec's Act respecting the protection of personal information in the private sector applies to enterprises, including law and notarial firms. "Law 25" is the 2021 statute that modernized it; most of its obligations have been in force since September 22, 2023.
Every firm has a person in charge of the protection of personal information: by default, the person with the highest authority. The role can be delegated in writing, and its title and contact details must be published on the firm's website (s. 3.1).
Before adopting the tool: the PIA
Section 3.3 requires a PIA for any project to acquire, develop or overhaul an information system that processes personal information. An AI tool that reads client files is one.
The person in charge must be consulted from the start of the project. The assessment is proportionate to the sensitivity, purpose, quantity, distribution and medium of the information. The system must also be able to return the information in a structured, commonly used format.
The steps are set out in our guide to the PIA before an AI tool.
If data leaves Québec
Many AI tools process data outside Québec. Before disclosing personal information to them, section 17 requires a PIA that takes four things into account:
- the sensitivity of the information;
- the purpose of its use;
- the protection measures, including contractual ones;
- the legal framework of the place where it will be disclosed.
Disclosure is allowed only if the information will receive adequate protection, and it must be covered by a written agreement that reflects the assessment. The same rule applies when someone outside Québec is entrusted with keeping or using information for the firm. "Outside Québec" includes the other provinces.
The contract with the provider
A firm may entrust personal information to a provider without the client's consent when this is necessary to carry out a mandate or service contract (s. 18.3). The contract must be in writing and provide, among other things, for:
- the provider's protection measures;
- use of the information limited to performing the contract;
- no retention after the contract ends;
- a duty to notify the person in charge of any breach and to allow audits.
This rule does not lift professional secrecy, which has its own requirements: see our guide to professional secrecy and AI.
Automated decisions and profiling
A decision based exclusively on automated processing, such as automatic sorting of client requests, must be disclosed to the person no later than when it is communicated to them. On request, the firm explains the information used, the reasons and the main factors, and the person may submit observations to someone able to review the decision (s. 12.1).
A tool able to identify, locate or profile a person requires informing them beforehand (s. 8.1).
If a confidentiality incident occurs
A confidentiality incident is access, use or disclosure not authorized by law, or the loss of personal information. A file entered into a tool without a legal basis can be one.
The firm must then take reasonable measures to reduce the risk. If the incident presents a risk of serious injury, it promptly notifies the Commission d'accès à l'information and the persons concerned. Every incident is recorded in a register (ss. 3.5 to 3.8).
Masking, pseudonymizing, anonymizing
Replacing names with codes reduces the risk, but the text remains personal information as long as the person can be found again.
Information is anonymized when it is reasonable to foresee, at all times, that it irreversibly no longer allows the person to be identified (s. 23). The anonymization regulation, in force since May 30, 2024, requires among other things an analysis of the re-identification risk.
Penalties
- Administrative monetary penalties: up to $50,000 for an individual; for an enterprise, up to $10,000,000 or 2% of worldwide turnover, whichever is greater.
- Penal fines: $5,000 to $100,000 for an individual; for an enterprise, $15,000 to $25,000,000 or 4% of worldwide turnover. They double for a repeat offence.
- Punitive damages of at least $1,000 for an intentional unlawful infringement or gross fault.
What Jurisync does
In private mode, Jurisync analyzes files on the firm's own computer or server: nothing leaves the firm. Public research flags names and numbers and offers a masked version before sending. Roles and the time-stamped activity log give you the facts if an incident occurs.
Jurisync helps you meet Law 25; compliance remains the firm's responsibility.
Frequently asked questions
Does Law 25 prohibit AI in a law firm?
No. It governs the processing of personal information: prior assessment, a contract with the provider, security measures, transparency for automated decisions.
Does a tool hosted in Ontario require a PIA?
Yes. Section 17 covers any disclosure outside Québec, including to another province.
Is masking names before sending enough?
It reduces the risk, but pseudonymized text generally remains personal information. Only anonymization within the meaning of section 23, which is irreversible, takes it outside the Act.
Who is responsible for compliance?
The firm. Its person in charge of the protection of personal information oversees the Act's application; a tool can help, not take that place.
Sources
Official texts consulted for this guide. Always check the version in force.
- Act respecting the protection of personal information in the private sector, CQLR c P-39.1
- Regulation respecting the anonymization of personal information, CQLR c A-2.1, r 0.1
- Act to modernize legislative provisions as regards the protection of personal information, SQ 2021, c 25 (in French)
- Commission d'accès à l'information, PIA guide (version 3.1, April 2024, in French)
This guide provides general information. It is not legal advice. Compliance remains each firm's responsibility.