If you run a law firm in Quebec, or you have Quebec clients, Law 25 applies to you, alongside the duty of confidentiality you already carry. It governs how any organization handling personal information must protect it, and it has real teeth. Here is what it means in practice, without the legalese.
What Law 25 asks of you
At its core the law says that if you collect and hold people's personal information, you are responsible for protecting it with appropriate security measures, being transparent about how you handle it, and handling confidentiality incidents properly when something goes wrong.
For a firm the relevant obligations land in a few concrete places. You should protect client information with real safeguards, and encryption and access controls are explicitly the kinds of measures regulators point to. You need to record and assess every confidentiality incident, and notify the Commission d'accès à l'information and affected clients when an incident presents a risk of serious injury. And you should know where client data lives and which laws govern it.
Why it matters more than the old rules
The penalties changed the calculus. Administrative monetary penalties under Law 25 reach up to $10 million or 2% of worldwide turnover, whichever is greater, and penal sanctions climb to $25 million or 4% for serious violations. For a practice built on client trust, a breach of privileged files is also the kind of reputational event that is hard to recover from.
What this looks like day to day
- Encrypt sensitive files, ideally before they leave your device, so no third party, including your software vendor, can read them.
- Control access with expiry, revocation, and limits on who can open what.
- Know where your data lives. Keeping it in Canada, under Canadian law, is not a Law 25 requirement, but it simplifies the assessment the law asks for when information leaves Quebec.
- Be able to show your work, that you used appropriate measures, not just good intentions.
How Privatt fits
Privatt is Canadian-owned, and Privatt-hosted storage keeps files on Canadian servers under Canadian law. Send and the Vault modes where you hold the keys encrypt on your device before anything is stored or sent, and you get expiry and revocation controls out of the box. It will not make you compliant on its own, because no tool does, but it is exactly the kind of appropriate security measure the law is asking for.
This article is general information, not legal advice. Consult a qualified professional about your specific obligations.