Quebec Privacy LawGuide for Small Business
The first 48 hours decide whether an incident becomes a documented, defensible event or a regulatory problem. Here's the sequence.
· IT & cybersecurity for Quebec SMBs since 1995
Under Law 25, a “confidentiality incident” is any unauthorized access, use, or communication of personal information, or its loss. That covers ransomware, but also a stolen laptop, a misdirected email, or an ex-employee's account that was never disabled. Whatever the size, the steps are the same.
Stop the bleeding first. Disable compromised accounts, isolate affected machines, revoke exposed credentials, recall the misdirected email if your platform allows it. Law 25 explicitly requires you to take reasonable measures to reduce the risk of harm and prevent recurrence, so containment isn't just good practice, it's an obligation.
Preserve evidence while you do it. Don't wipe and reimage a compromised machine before capturing what happened; you'll need the timeline for the steps below.
Notification hinges on one question: does the incident present a serious risk of injury to the people affected? Law 25 tells you what to weigh:
Involve your designated privacy officer in this assessment, and write down the reasoning, whichever way it goes. An incident you assessed as low-risk with documented reasons is defensible. The same incident with no paper trail isn't.
If you conclude there's a serious risk of injury, you must notify the CAI and the affected individuals, with diligence and without delay. There's no fixed 72-hour clock like Europe's GDPR, but sitting on it for weeks fails the standard. The CAI provides an incident report form on cai.gouv.qc.ca.
You may also need to notify third parties who can reduce the harm, such as your bank or a credit-monitoring service. If another organization's systems were involved (your payroll provider, for example), coordinate so notifications are consistent.
Every confidentiality incident goes in the register, including ones that didn't meet the serious-harm bar. Record the date, what happened, what information was involved, how many people were affected, your risk assessment and its reasoning, who was notified, and what you changed afterward. The CAI can request this register during any investigation, and a well-kept one is your best evidence of good faith.
Once the dust settles, close the hole that let it happen: enforce MFA, patch the exposed system, tighten access rights, train the team member who clicked. Law 25 expects measures to prevent recurrence, and the follow-up is what turns one incident into a stronger security posture rather than a repeat performance.
Every step above goes faster if the plumbing exists in advance: a named privacy officer, a running incident register, tested backups, and a one-page response plan that says who assesses, who notifies, and who talks to clients. The self-assessment will show you in five minutes whether you have those pieces.