Law 25: what your internal tools must comply with

Most companies treated Law 25 as a cookie banner exercise on their website. Meanwhile their CRM, their payroll system and their dispatch tool hold far more sensitive personal information, with none of those obligations applied.

What Law 25 actually covers

The law targets personal information wherever it sits. A name, an address, a phone number, a performance review, a customer complaint, a photo taken on a job site: all of it falls inside the scope, whether it lives on a public site or in a tool only your employees can reach.

The law draws no line between a public form and an internal dashboard. The information is the same.

An internal system often concentrates more sensitive information than a website will ever see. That is precisely why it deserves the same seriousness.

The five obligations that touch an internal tool

Without quoting the statute, here is what translates concretely into how software gets built.

1. A stated purpose per field. You must know why each piece of information is collected. A field with no reason to exist should not exist.
2. Consent where it is required. It is not required everywhere, but where it is, it must be clear, separate and documented.
3. Retention and destruction rules. Information is not kept indefinitely just in case. There has to be a duration, and a destruction that actually runs.
4. A right of access and correction. A person can ask what you hold about them and have an error corrected. That request has to be answerable without involving a developer.
5. An incident procedure. When a confidentiality incident presents a serious risk, you must be able to react, record and notify.

What that changes in the build

These obligations do not get added at the end of a project, they shape its structure. In practice they translate into specific technical decisions.

Role based access comes first. Every user sees what their function requires and nothing more. We define the roles with the client before designing the first screen, because permissions bolted on afterwards always let something through.

The audit trail comes next. Who changed what, when, and from where. That table looks pointless for two years, then becomes the most valuable one in the database the day a record disappears or a client disputes what was agreed.

Then comes minimisation, the most effective measure and the least applied. The cheapest data to protect, and the only kind that cannot leak or be subpoenaed, is the data you never kept. We regularly recommend removing fields from an existing form. Our full practice is described in the security section of this site.

Where responsibility sits with rented software

This question comes up on every call. With a subscription, you remain responsible for the information you collect, even when it is hosted by a vendor. The law does not transfer that responsibility.

Three points are worth checking in your current contract: where the data is physically hosted, what the vendor allows itself to do with it, and what happens on termination. The third answer is often the most uncomfortable, because complete destruction is rarely guaranteed.

With a system you own, those three answers belong to you. You choose the hosting region, nobody else mines the data, and destruction is an operation you run yourself.

Where to start if nothing has been done

An inventory, before anything else. List your tools, and for each one, what personal information it holds. The exercise takes half a day and almost always surfaces two or three systems nobody remembered.

Only then, prioritise. The system holding employee files comes before the one keeping delivery addresses. And if a tool holds nothing personal, it needs no work at all: saying so clearly is part of the job too.

What Law 25 does not require

It is worth naming the myths too, because fear sells a lot of unnecessary services.

Law 25 does not require your data to be hosted in Quebec. It requires you to know where it is and that the protection there is equivalent. Canadian hosting is a prudent and often desirable choice, not an obligation.

It does not require a certification, an annual external audit or specialised software either. For a small company, most of the work is knowing what you hold, why, for how long, and who can reach it. A well designed tool answers those four questions with no extra effort.

Finally, it does not apply to properly anonymised data. That route is often overlooked: some analysis does not need to identify anyone, and simply removing the identifier takes the data out of scope.