This Quebec law modernizing legislation on the protection of personal information in the private sector, is of the same order as the General Data Protection Regulation in Europe better known as the GDPR.
Its objective is to provide a framework for the protection of personal information held by businesses. It applies in respect of personal information that a company collects, holds, uses, discloses to, retains or destroys, regardless of the nature of the medium and the form in which the personal information is held, written, graphic, audible, visual, computerized or other.
Personal information is information that relates to a natural person and allows that person to be identifiable. It is confidential. Except in exceptional cases, they may not be disclosed without the consent of the person concerned.
A company that collects, holds, uses, discloses, retains or destroys personal information has several obligations under the Act respecting the personal information in the Private Sector Privacy Act (The Private Sector Act).
In addition to respecting the pre-existing obligations regarding the protection of personal information, since September 22, 2022, you must in particular:
In addition, from September 22, 2023, private organizations must, among other things:
In addition, depending on the nature and scope of your business activities, other obligations may exist with respect to the protection of personal information.
To learn more about your personal information protection obligations and the actions to take to comply with them, visit: necando.com/en/act-25/
Necando helps North American organizations optimize their most valuable corporate assets – people and data. We have worked with government agencies, financing, transportation, etc. Our rich and diversified experience and understanding combined with the IBM data solutions portfolio are what we are proud to provide to our clients.