Communicating personal information outside Quebec
The test is not only about the United States. Hosting in Ontario or in Europe is already a communication outside Quebec.
Before communicating personal information outside Quebec, the enterprise carries out a written assessment. It may communicate the information only if the assessment shows that the information would receive adequate protection, including in light of generally recognized principles. The agreement with the recipient takes the result into account, including measures that reduce the risks found. This rule has been in force since 22 September 2023.
When the assessment applies
Cloud outside Quebec
An AWS, Azure or Google region in the United States, Ontario or Europe. A vendor office in Montreal does not change the analysis if the data is processed elsewhere.
A subsidiary or a team outside the province
Payroll run from a head office in Ontario, or support staff opening files from France. A communication to another company in the group counts.
Your supplier's supplier
Your integrator is in Quebec, but its analytics tool is hosted elsewhere. Ask for the chain. The assessment is about where the information ends up.
The four factors to write down
The assessment stays in the file. It is not a paragraph of the public policy.
1. Sensitivity
Health, finances, employee information, identifiers. The more sensitive the information, the higher the protection you need to show.
2. Purposes of use
Hosting only, or also analytics, support, training a model. A wider purpose changes the risk.
3. Protection measures
Encryption, access control, where backups sit, a contractual promise not to use the information for anything else.
4. The legal regime of the State
The rules that apply where the information is received, including whether an authority can obtain it. A vendor certificate does not replace that reading.
The written agreement
If the assessment finds adequate protection, the agreement restates the measures you rely on. It limits use to the stated purposes, requires notice of an incident, and says what happens to the information when the contract ends. If the assessment does not find adequate protection, a sentence in a purchase order does not repair it.
The link with the policy
The privacy policy states that information may be communicated outside Quebec. It does not replace the assessment. Keep the assessment, its date and the version of the agreement in the processing file.
Related guides and articles
One assessment per activity, not a general opinion
CapPRP keeps the assessment, the agreement and the hosting location next to the activity they belong to.