Quebec Law 25 — Private Sector personal-information modernisation

Quebec Law 25 — Private Sector personal-information modernisation — 80% of in-scope requirements covered.

5 requirements · 5 in scope (3 enforced · 2 designed). The 80% is weighted over the in-scope base.

Quebec Law 25: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. 3 · enforced

    Section 3.3 — Privacy impact assessment: conduct a PIA before any project to acquire, develop or overhaul an…

    Audit events: kye.risk_assessment.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

  2. 1 · enforced

    Section 12.1 — Automated decision-making: when a decision is based exclusively on automated processing…

    Audit events: kye.evidence.decision_map.v1, kye.replay.proof.v1 · Constitution: 13 resilience loop

  3. s12 · enforced

    Section 12 — Use limitation + consent for sensitive information: personal information must be used only for…

    Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1 · Constitution: 12 purpose permission

  4. 5 · designed

    Sections 3.5-3.8 — Confidentiality incidents: keep a register of incidents and, where there is a risk of…

    Audit events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1 · Constitution: 13 resilience loop

  5. s27 · designed

    Section 27 — Data portability: on request, communicate computerised personal information collected from the…

    Audit events: kye.evidence.pack.v1, kye.evidence.decision_map.v1 · Constitution: 31 data governance pack

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: An Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25 (Law 25 / former Bill 64), amending the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1). Privacy-impact-assessment duty (s.3.3), automated-decision transparency + right to submit observations (s.12.1 / s.65.2), confidentiality-incident reporting to the CAI (s.3.5-3.8), data portability (s.27), and consent for sensitive information (s.12).

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Privacy impact assessment (s.3.3)11000100%
Automated-decision transparency (s.12.1)11000100%
Confidentiality-incident reporting (s.3.5-3.8)1010050%
Data portability (s.27)1010050%
Consent for sensitive information (s.12)11000100%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
quebec-law-25.s3.3Section 3.3 — Privacy impact assessment: conduct a PIA before any project to acquire, develop or overhaul an information system or electronic-service-delivery system involving personal informationenforcedaudit_events: kye.risk_assessment.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
quebec-law-25.s12.1Section 12.1 — Automated decision-making: when a decision is based exclusively on automated processing, inform the individual and, on request, of the personal information used, the reasons and principal factors, and the right to submit observationsenforcedaudit_events: kye.evidence.decision_map.v1, kye.replay.proof.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
quebec-law-25.s3.5Sections 3.5-3.8 — Confidentiality incidents: keep a register of incidents and, where there is a risk of serious injury, notify the Commission d'accès à l'information and the affected individualsdesignedaudit_events: kye.signal.incident.opened.v1, kye.compliance.attestation.v1
engines: internal, internal
constitution_refs: constitution/13-RESILIENCE-LOOP.md
quebec-law-25.s27Section 27 — Data portability: on request, communicate computerised personal information collected from the individual in a structured, commonly used technological formatdesignedaudit_events: kye.evidence.pack.v1, kye.evidence.decision_map.v1
engines: internal, internal
constitution_refs: constitution/31-DATA-GOVERNANCE-PACK.md
quebec-law-25.s12Section 12 — Use limitation + consent for sensitive information: personal information must be used only for the purposes for which it was collected, and express consent is required for sensitive personal informationenforcedaudit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1
engines: internal, internal
constitution_refs: constitution/12-PURPOSE-PERMISSION.md

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.