Law 25 for a municipality, a clinic or a nonprofit
The statute changes with the status. The work starts with the same records: a published officer, an incident register, and an assessment before information leaves Quebec.
Which statute
- Municipality, school service centre, public health institution: the Act respecting access to documents held by public bodies, as amended by Law 25.
- Private clinic, professional office, business, and a nonprofit that operates an enterprise toward clients, members, donors or employees: the Act respecting the protection of personal information in the private sector.
- A nonprofit that is also a public body follows the public-sector act. Legal status decides, not the word association on the website.
The records both regimes need
1. A published officer
Name the person in charge of the protection of personal information and publish their title and contact details. In an enterprise, if nobody is designated, the person with the highest authority is responsible.
2. A register of every incident
Unauthorized access, use or communication, or loss of information. Notice to the Commission and to the persons covers a risk of serious injury. The register also keeps the other incidents, for at least five years.
3. An assessment before information leaves Quebec
A cloud in another province is already outside Quebec. The written assessment comes before the communication, with an agreement.
4. An assessment before a system or an electronic service
A project to acquire, develop or overhaul an information system or an electronic service delivery that involves personal information: complete the privacy impact assessment before you launch.
What weighs more in each setting
In a clinic, health information is sensitive: when consent is the basis, it is express. In a municipality, functions that identify, locate or profile a resident stay off until the person activates them, and the person is told how to do that. In a nonprofit, the member or donor list is used for the purpose you stated, and a fundraising newsletter is requested separately.
Tie these records to the sector you are in. The privacy policy guide and the transfer assessment template are useful under both regimes.
The same file, whichever regime applies
CapGRC tracks the officer, incidents, assessments and evidence for a public body and for an enterprise.