Guide
Quebec Law 25 for an MSP what the law asks of an IT provider
Under Quebec’s Law 25, an MSP plays two roles: mandatary of its clients, with a written contract that sets out protective measures (s. 18.3), and a business with personal information of its own, which needs a designated person in charge and an incident register. OKTO PSA, hosted in Quebec, keeps passwords out of tickets with secret notes.
This guide does not replace legal advice. It summarizes the Act and cites its sections so you can read them at the source.
Does Law 25 apply to an IT service provider?
Yes, in two ways. Law 25 amended Quebec’s Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1). It applies to anyone who carries on an enterprise in Quebec, which means your clients, and you too.
For your clients, you are a mandatary: they hand you personal information, and the Act wants a written contract that says how you protect it. For yourself, you are a business with employees, clients and obligations of its own.
The MSP as mandatary
Clients give you access to workstations, mailboxes and employee files. Section 18.3 lets them do that without each person’s consent, as long as there is a written mandate with specific protective measures.
The MSP as a business
Your own PSA holds client contacts, ticket notes and employee records. Sections 3.1 to 3.8 apply to you directly: a designated person in charge, policies, and an incident register.
What must the client contract say (s. 18.3)?
The mandate is in writing, and it states the measures you must take. A confirmation email is not enough. The Act lists what has to be in it.
Confidentiality
How you protect the confidentiality of the information you receive: limited access, protected passwords, encrypted devices.
Limited use
The information is used only to carry out the mandate, for example fixing a workstation or preparing an employee departure, and for nothing else.
End of the contract
You do not keep the information after the contract expires. Plan a return or destruction date, and who confirms it.
Notice without delay
You must notify the client’s person in charge of personal information protection without delay of any breach or attempted breach, and let them verify confidentiality.
Who notifies the Commission?
The Act addresses the business that holds the information. When an incident involves a client’s data, your first job is to tell the client, fast. Your contract should say who writes the notice to the Commission d’accès à l’information and who contacts the people affected.
What do you do after a confidentiality incident?
An incident is unauthorized access, use or disclosure of personal information, or its loss (s. 3.6). A stolen laptop, an email sent to the wrong person and a compromised account all count. Here is the order to follow.
Reduce the harm
As soon as you have reason to believe an incident happened, take reasonable steps to lower the risk and prevent a repeat (s. 3.5).
Assess the risk of harm
Weigh the sensitivity of the information, the likely consequences and the probability of harmful use, and consult your person in charge (s. 3.7).
Notify if the risk is serious
Promptly notify the Commission d’accès à l’information and the people affected when the incident presents a risk of serious harm (s. 3.5).
Record it in the register
Every incident goes in the register, even without serious risk (s. 3.8). The Commission can ask for a copy, and it states that entries are kept for at least five years.
When is a privacy impact assessment required?
In two cases that hit an MSP directly: section 17 for any disclosure outside Quebec, and section 3.3 for acquiring or overhauling an information system.
Outside Quebec (s. 17)
Before disclosing personal information outside Quebec, or entrusting someone outside Quebec to keep it, the business assesses the sensitivity of the information, its purpose, the protections it would have (contractual ones included) and the legal regime of the destination. If protection is adequate, a written agreement follows. A remote support tool or a PSA hosted abroad falls under this, on your side and on your client’s.
New system (s. 3.3)
Choosing new software that collects or keeps personal information also calls for an assessment, with the person in charge consulted from the start of the project. Switching PSA counts. The assessment is proportionate to how sensitive the data is, and the Commission publishes a guide on it.
Who is responsible, and what do you keep?
The Act asks for named people and written rules. Nothing heavy for a small MSP, but all of it has to exist on paper.
The person in charge (s. 3.1)
By default it is the person with the highest authority, who can delegate in writing. Their title and contact details are published on the business’s website.
The policies (s. 3.2)
Retention and destruction, staff roles, and a complaints process. They are proportionate to the size of the business and approved by the person in charge.
Destruction (s. 23)
Once the purpose of collection is achieved, the information is destroyed or anonymized, unless a law sets a retention period.
What should PSA software let you do?
The Act says nothing about software, but its requirements turn into questions to ask any vendor, OKTO PSA included.
A known hosting location
Where the database lives, and who else touches it. OKTO PSA is hosted in Quebec, with a dedicated database for each client. The list of subprocessors is on the data processing page.
Role-based access
A technician sees only what the role requires. Ask how roles are set and who can change them.
An activity log
To respond to an incident, you need to know who did what. Ask what the log keeps and for how long.
Passwords kept out of tickets
A password written in plain text in a ticket stays readable by anyone who opens it. OKTO PSA offers encrypted secret notes (AES-256-GCM) that can be read only once.
Finding one person’s information
When someone asks for access to their information (s. 27), you must be able to find it and hand over a copy. Ask how to search and export in the software.
Controlled sign-in
The OKTO PSA client portal accepts sign-in with Microsoft or Google. When an employee leaves, the Microsoft 365 account is blocked, never deleted (a feature offered to IT providers, on request).
What this guide does not do
Using OKTO PSA does not make an MSP compliant with Law 25: compliance depends on each provider’s contracts, policies and practices. This guide does not replace legal advice. For a specific case, talk to your adviser. Software details are on the security page and the data processing page.
Sources
- Act respecting the protection of personal information in the private sector, CQLR, c. P-39.1, Légis Québec: sections 3.1 to 3.8, 10, 17, 18.3, 23 and 27, consulted October 27, 2026.
- Confidentiality incidents and security measures, Commission d’accès à l’information (in French), consulted October 27, 2026.
- Conducting a privacy impact assessment, Commission d’accès à l’information guide (in French), consulted October 27, 2026.
Frequent questions
The questions we get asked
Your question is not here?
Write to us. A person in Trois-Rivières answers, within one business day.
Ask your questionThe Act speaks of a mandatary or the person carrying out a service contract (s. 18.3). An MSP that a client gives access to personal information falls in that group: it must work under a written mandate that states the protective measures.
The Act requires the business that holds the information to notify the Commission and the people affected when there is a risk of serious harm (s. 3.5). The mandatary must notify the client’s person in charge without delay (s. 18.3). The contract should say who does what.
Yes. Section 3.8 requires a register of all confidentiality incidents, and the Commission can ask for a copy. It states that entries are kept at least five years.
Before disclosing personal information outside Quebec (s. 17), and for any project to acquire or overhaul an information system that involves personal information (s. 3.3).
No, no software does that alone. OKTO PSA is hosted in Quebec, with a dedicated database per client and secret notes for passwords, but compliance depends on your contracts and practices.
See where your data lives
Write to us for an OKTO PSA demo. We will show you the hosting, the roles and the secret notes.
OKTO Solutions, Trois-Rivières, Quebec