Describe your business, leave with a checklist you can assign

Section 12.1 requires an enterprise that uses personal information to render a decision based exclusively on automated processing to inform the person accordingly no later than when it informs them of the decision, and on request to inform them of (i) the personal information used, (ii) the reasons and the principal factors and parameters that led to the decision, and (iii) their right to have the personal information used to render the decision corrected. It must also give the person the opportunity to submit observations to a member of personnel in a position to review the decision. Engineering implications: an explanation layer that maps model output onto principal factors and parameters; retention of the input snapshot at decision time so correction requests can be honoured; and a human ticket path that delivers observations to someone with authority to review.

Evidence: Inventory of solely automated decisions and the notice copy (French and English); Sample explanation output for the reasons, principal factors and parameters, with the method used to generate it; Retention policy for decision-time input snapshots and evidence of retrieval; Observation intake and human review ticket records, evidencing the reviewer’s authority

Section 17 requires a privacy impact assessment before communicating personal information outside Québec, taking into account in particular the sensitivity of the information, the purposes for which it is to be used, the protection measures including contractual ones that would apply, and the legal framework applicable in the destination State including the personal information protection principles applicable there. The information may be communicated only if the assessment establishes it would receive adequate protection, in particular in light of generally recognised principles, and the communication must be the subject of a written agreement that takes into account, in particular, the assessment results and any agreed terms to mitigate the identified risks. The same applies where a person or body outside Québec is entrusted with collecting, using, communicating or keeping the information. “Outside Québec” includes other Canadian provinces. The closing paragraph of section 17 disapplies it only to a communication under subparagraph 7 of the first paragraph of section 18 (one of the consent-free communication cases); there is no other carve-out.

Evidence: Section 17 privacy impact assessment covering the four statutory factors; Analysis of the destination’s legal framework, benchmarked against its personal information protection principles; Executed written agreement reflecting the assessment conclusions and mitigation terms; Transfer register and periodic re-assessment records triggered by changes of recipient or legal environment

Open tool: Transfer Matrix

Section 3.5 requires a person carrying on an enterprise who has cause to believe a confidentiality incident involving personal information they hold has occurred to take reasonable measures to reduce the risk of injury and prevent recurrence; where the incident presents a risk of serious injury, to promptly notify the Commission d’accès à l’information and each person whose personal information is concerned (failing which the Commission may order notification); and permits notifying any person or body that could reduce the risk, communicating only the personal information necessary, in which case the person in charge of the protection of personal information must record that communication. Section 3.7 requires the risk assessment to consider in particular the sensitivity of the information, the anticipated consequences of its use and the likelihood it will be used for injurious purposes, in consultation with the person in charge. Section 3.8 requires a register of confidentiality incidents, whose content may be determined by government regulation.

Evidence: Register of confidentiality incidents with the fields required by regulation; Serious-injury risk assessments, evidencing consultation with the person in charge; Notification texts to the Commission and to individuals, with proof of delivery; Records of communications to third parties able to reduce the risk, documenting the minimisation

AI incident and serious incident reporting record (register plus report drafts)

Section 3.3 requires a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, keeping or destruction of personal information — introducing or re-architecting AI capability (model integration, vector retrieval, voice or image processing) normally falls squarely within “overhaul an information system”. Section 3.1 makes the person carrying on an enterprise responsible for protecting the personal information they hold. Section 8.2 requires anyone who collects personal information through technological means to publish a confidentiality policy drafted in clear and simple language on the enterprise’s website, if applicable, and to disseminate it by any appropriate means, and to do the same for notice of any amendment.

Evidence: Privacy impact assessment files and conclusions, organised by project; Project initiation and assessment trigger records for AI introduction or re-architecture; Published French-language confidentiality policy versions and amendment notices; Records of the person in charge’s involvement in and sign-off on the assessments

Section 27 requires an enterprise, on request, to confirm the existence of the personal information it holds about a person, communicate it and allow them to obtain a copy; at the applicant’s request, computerised personal information must be communicated as a written and intelligible transcript. From 22 September 2024, unless doing so raises serious practical difficulties, computerised personal information collected from the applicant and not created or inferred using personal information concerning them must, on request, be communicated in a structured, commonly used technological format and also communicated to any person or body authorised by law to collect it. Where the applicant is handicapped, reasonable accommodation must be provided on request. Section 28 adds the right to require rectification where the information is inaccurate, incomplete or equivocal, or where its collection, communication or keeping is not authorised by law. AI companies should define in advance the boundary of “created or inferred” information — inferred profile labels, embeddings and scores are usually outside the portability scope, but the reasoning must be documented.

Evidence: Access and portability request procedure with turnaround records; Documented classification between information collected from the applicant and information created or inferred; Structured export format specification and sample exports; Reasoning for refusals or partial refusals, including any “serious practical difficulties” analysis

Section 10.1(1) requires a report to the Commissioner where it is reasonable in the circumstances to believe that a breach of security safeguards creates a real risk of significant harm to an individual; section 10.1(2) requires the prescribed form and manner, as soon as feasible after the organisation determines the breach occurred; sections 10.1(3) and (6) require direct, conspicuous notification of affected individuals as soon as feasible (indirect notification in prescribed circumstances). Section 10.1(7) defines significant harm to include bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record, and damage to or loss of property. Section 10.1(8) lists the real-risk factors: the sensitivity of the information involved, the probability that it has been, is being or will be misused, and any other prescribed factor.

Evidence: Methodology for assessing real risk of significant harm and the per-incident assessments; Report filed with the Commissioner and its acknowledgement; Individual notification text and proof of delivery method; Records of section 10.2 notifications to other organisations or government institutions

AI incident and serious incident reporting record (register plus report drafts)

Schedule 1 clause 4.1.3 makes an organisation responsible for personal information in its possession or custody, including information transferred to a third party for processing, and requires contractual or other means to provide a comparable level of protection during that processing. For Canadian data handed to a Chinese parent, offshore cloud or labelling vendor this means: purpose limitation and no-secondary-use clauses in the data processing agreement, sub-processor approval, a security control schedule, audit and inspection rights, incident notification timelines, a government access request and notification mechanism, and return or destruction on termination. On transparency, the OPC expects organisations to state in their privacy policy that personal information may be processed outside Canada and thereby become subject to local law.

Evidence: Data processing agreement with comparable-protection, sub-processor and audit clauses; Vendor security due diligence questionnaire and assessment conclusion; Privacy policy wording disclosing offshore processing; Evidence of data return or destruction on termination

Open tool: Transfer Matrix

Section 10.3(1) requires an organisation to keep and maintain a record of every breach of security safeguards involving personal information under its control, in the prescribed form — not only those meeting the real-risk threshold — and the Commissioner may request access to it. So even where the assessment concludes that no report is required, the assessment itself must be retained, or the organisation cannot substantiate its decision in an investigation. Knowingly contravening section 10.3(1) is an offence under section 28.

Evidence: Complete breach register, including incidents assessed as not reportable; Risk assessment conclusion and reasoning for each incident; Retention period and access control policy for the register; Procedure for producing the register to the Commissioner

AI incident and serious incident reporting record (register plus report drafts)

The Schedule 1 principles require purposes to be identified at or before collection, knowledge and consent for collection, use and disclosure, collection limited to what is necessary for the identified purposes, and collection by fair and lawful means. The recurring AI flashpoint is whether using user input, conversation logs or uploads for model training falls within the original purpose; in practice, list the training use separately, explain it understandably, offer a choice, and re-obtain consent on a change of purpose. The limiting use, disclosure and retention principle also requires retention periods and destruction at expiry, which directly constrains how long prompt logs and training snapshots may be kept.

Evidence: Purpose inventory and necessity analysis for each collection; Screenshots and version history of consent interfaces, including the separate training-use explanation; Retention matrix and evidence of destruction at expiry; Process and records for re-obtaining consent on a change of purpose

The individual access principle requires an organisation, on request, to inform an individual of the existence, use and disclosure of their personal information and give access, and to allow them to challenge its accuracy and completeness and have it amended. The challenging compliance principle requires a designated individual accountable for compliance and procedures for individuals to challenge it. Section 14 lets a complainant apply to the Federal Court for a hearing on matters covered by the Commissioner’s report after receiving it or being notified the investigation was discontinued. Define in advance: the search scope for access requests (whether prompt logs, vector stores and model outputs are included), identity verification, how third-party information is handled, and how refusals are documented.

Evidence: Access request procedure and documented search scope; Access request log (receipt date, response date, what was provided or refused and why); Designation of the individual accountable for compliance and the published channel; Records of compliance challenges received and how they were handled