As a notary in Quebec you already live by professional secrecy. Law 25 sits alongside that duty and adds a concrete set of obligations for how you protect the personal information in your files. You do not need a law degree to understand the gist. Here is what it means in practice.
What Law 25 asks of you
At its core the law says that if you collect and hold people's personal information, you are responsible for protecting it with appropriate security measures, being transparent about how you handle it, and handling confidentiality incidents properly when something goes wrong.
For a notary's office the relevant obligations land in a few concrete places. You should protect client information with real safeguards, and encryption and access controls are explicitly the kinds of measures regulators point to. You need to record and assess every confidentiality incident, and notify the Commission d'accès à l'information and the people affected when an incident presents a risk of serious injury. And you should know where your data lives and which laws govern it.
Why it matters
The penalties changed the calculus. Administrative monetary penalties under Law 25 reach up to $10 million or 2% of worldwide turnover, whichever is greater, and penal sanctions climb to $25 million or 4% for serious violations. Beyond the numbers, a breach that exposes a client's will or estate file is precisely the kind of event a practice built on trust cannot easily absorb.
What this looks like day to day
You do not have to overhaul your office. In practice, compliance-minded document handling means a few habits:
- Encrypt sensitive files, ideally before they leave your device, so no third party, including your software vendor, can read them.
- Control access with expiry, revocation, and limits on who can open what.
- Know where your data lives. Keeping it in Canada, under Canadian law, is not a Law 25 requirement, but it simplifies the assessment the law asks for when information leaves Quebec.
- Be able to show your work, that you used appropriate measures, not just good intentions.
How Privatt fits
Privatt is Canadian-owned, and Privatt-hosted storage keeps files on Canadian servers under Canadian law. Send and the Vault modes where you hold the keys encrypt on your device before anything is stored or sent, and you get expiry and revocation controls out of the box. It will not make you compliant on its own, because no tool does, but it is exactly the kind of appropriate security measure the law is asking for, and it removes the riskiest habit most offices still have, which is sending confidential documents by plain email.
This article is general information, not legal advice. Consult a qualified professional about your specific obligations.