Quebec private sector Act, section 17: privacy impact assessment before communicating information outside Quebec (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 17, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
A Quebec holder must run a privacy impact assessment before communicating personal information outside Quebec (the US included) and may proceed only if it shows adequate protection under generally recognized privacy principles. The communication must also be covered by a written agreement that reflects the assessment.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment. ... The information may be communicated if the assessment establishes that it would receive adequate protection, in particular in light of generally recognized principles regarding the protection of personal information. The communication of the information must be the subject of a written agreement that takes into account, in particular, the results of the assessment and, if applicable, the terms agreed on to mitigate the risks identified in the assessment.”
Where it was read
Also read from the same source
- For customers or staff in Canada, has each person consented to this new use, or will the data be anonymised to the Canadian standard before it leaves? For Quebec, is the privacy impact assessment done and the written agreement ready?
- Quebec private sector Act, section 12: use for another purpose needs consent or an exception (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 12, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
- Quebec private sector Act, section 12: de-identified information is still personal information (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 12, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
- Quebec private sector Act, section 13: communicating personal information to a third person needs consent (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 13, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
- Quebec private sector Act, section 14: consent must be clear, free, informed and specific (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 14, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
- Quebec private sector Act, section 18.4: the commercial transaction exception (Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, s. 18.4, as amended by S.Q. 2021, c. 25 (in force 22 September 2023))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides