Turn the Client Questionnaire Into Responsibilities
For an MSP handling information in an arrangement subject to Quebec's private-sector privacy law, clarify the client's requirements before selecting tools or subcontractors. A product claim that it is compliant does not establish how your particular service handles personal information.
| MSP Decision | What to Put in Place |
|---|---|
| Accountability | Identify the person responsible for personal information and publish their title and contact details as required. |
| Confidentiality incidents | Keep an incident register; assess risk and notify the CAI and affected people when there is a risk of serious injury. |
| Processing outside Quebec | Support the required privacy impact assessment before information is communicated outside Quebec and document the arrangement. |
Agree What the MSP Must Supply
Map support access, backups, logs and subcontractors so the client can evaluate where information goes. Record who receives an incident alert, supplies investigation evidence and answers privacy requests. Have the agreement reflect those responsibilities and the legal requirements for the actual arrangement.
Use the current private-sector statute and the CAI's guidance when reviewing the contract. Do not substitute a generic HIPAA or PIPEDA clause for that review.
Common Questions
Does Law 25 mean information can never leave Quebec?
The CAI describes an assessment and written-agreement process for permitted transfers. Check the required assessment and protection for the specific transfer before using a service outside Quebec.