In brief
The direct answer
Privacy work begins before a digital interface is finished. Teams need to map the personal information entering the service, its purpose, access, service providers, locations, retention and rights workflows, then assign accountable roles and evidence for each decision.
Key takeaways
What to carry into the next decision
- Treat privacy as a project responsibility that affects forms, databases, permissions, integrations, logs, contracts and support procedures.
- Name accountable roles and map the information collected, its purpose, basis or consent, users, providers, location, retention and disposal path.
- Plan privacy impact work, protective defaults and rights-request workflows before launch.
- Give retention, deletion and incident responsibilities named owners and verifiable evidence.
Privacy work begins before the interface is finished
A digital project affects more than the privacy-policy page. Teams need to understand what personal information enters the service, why it is needed, who can access it, where suppliers process it, how long it remains and how a person can exercise their rights. Those decisions influence forms, databases, permissions, integrations, logs, contracts and support procedures.
Seven checkpoints for websites and digital systems
- Name the accountable roles. Confirm the privacy officer, system owner, data owners, administrators and people responsible for requests, incidents and supplier oversight.
- Map personal information. Record the information collected, its source, purpose, legal basis or consent, internal users, service providers, location, retention and disposal path.
- Limit collection and explain it clearly. Forms and notices should ask only for information needed for a defined purpose and explain collection, use, sharing and applicable rights in plain language.
- Plan privacy impact work early. Quebec's Commission d'accès à l'information identifies privacy impact assessments for projects that acquire, develop or redesign information systems or electronic services involving personal information, and before communicating personal information outside Quebec.
- Set protective defaults. Public-facing technological products and services should be reviewed for the highest privacy settings by default where the statutory requirement applies, alongside secure roles and minimal permissions.
- Build the request workflow. Assign intake, identity verification, search, review, correction, access and portability steps so a rights request is not handled informally across inboxes.
- Prepare retention, deletion and incident response. Define schedules, legal holds, disposal, backups, incident assessment, records and notification responsibilities before a problem occurs.
Procurement questions that expose hidden privacy risk
- Which service providers and subprocessors handle personal information, in which locations and for which purpose?
- Can administrators restrict access by role and review access or change logs?
- How are records exported, corrected, deleted and removed from backups at the end of retention?
- How quickly will the provider report a suspected incident, and what evidence will it provide?
- What configuration, training and documentation remain the client's responsibility?
Compliance needs legal, operational and technical owners
Legal advice can identify obligations, but implementation still depends on forms, content, system design, access, contracts and day-to-day procedures. Give every action an owner and evidence: an approved notice, completed assessment, configured role, tested request workflow, retention schedule or incident exercise.
This guide is general information, not legal advice. Confirm requirements for your organization with qualified counsel and the Commission d'accès à l'information du Québec.
Primary sources
References used for this guide
- Commission d'accès à l'information du Québec — Main changes introduced by Law 25
- Légis Québec — Act respecting the protection of personal information in the private sector
- Commission d'accès à l'information du Québec — Privacy impact assessment guidance
Asban reviews source material for practical implementation context. Requirements can change and may vary by organization, sector and jurisdiction.
Frequently asked questions
Questions teams ask about Privacy
When should privacy work begin on a digital project?
Before the interface is finished. Early decisions about collection, access, providers, retention and rights affect forms, databases, permissions, integrations, logs, contracts and support procedures.
What should a personal-information map record?
Record the information collected, its source, purpose, legal basis or consent, internal users, service providers, location, retention and disposal path.
What privacy questions should teams ask service providers?
Ask which providers and subprocessors handle information, where and why; how access and logs work; how records and backups are deleted; how incidents are reported; and which configuration, training and documentation remain the client's responsibility.
Is this Quebec Law 25 checklist legal advice?
No. It is general information for digital-project implementation. Confirm the requirements for your organization with qualified counsel and the Commission d'accès à l'information du Québec.
Source notePrepared with the primary references above and updated . Confirm current requirements for your organization and jurisdiction.
