How to Report a Data Breach in Quebec (Law 25 Step-by-Step)
Step 1 — contain and assess
Stop the exposure (reset credentials, isolate systems), then assess: what data, how many people, and is there a “risk of serious injury” (identity theft, fraud, humiliation, damage to reputation)?
Step 2 — notify when risk is serious
If there is a risk of serious injury, notify the Commission d’accès à l’information (CAI) and the affected individuals promptly. The notice must describe the breach, the data involved, and what you and they should do.
Step 3 — keep a breach register
Law 25 requires a register of all confidentiality incidents, even minor ones. Record date, nature, data involved, assessment and actions taken. The CAI can ask to see it.
Action checklist
- ✅ Contain the breach (reset, isolate, revoke access)
- ✅ Assess data, scope and risk of serious injury
- ✅ Notify the CAI and affected individuals if risk is serious
- ✅ Log the incident in your breach register
- ✅ Review what failed and close the gap
FAQ
Who do I notify after a data breach in Quebec?
If the breach poses a risk of serious injury, notify the Commission d'accès à l'information (CAI) and the affected individuals promptly. All incidents must be recorded in your breach register regardless of severity.
Do I have to report every data breach in Quebec?
You must record every confidentiality incident in a register, but external notification (CAI and individuals) is required when there is a risk of serious injury. Containing and assessing first tells you which applies.
Get a free assessment
Tell us where you are — we send back a clear, no-pressure plan. Leads only, no payment.