Law 25 for Quebec insurance brokers: what it asks of you, and of your CRM
Quebec's Law 25 applies to a brokerage of any size that holds personal information about people in Quebec. This guide sets out what the law asks for, in the order it came into force, and which parts touch the system where your client records live.
General information for brokers, not legal advice. The Commission d'accès à l'information du Québec (CAI) publishes the authoritative guidance, and your own obligations depend on your practice.
What Law 25 is
Law 25 is the common name for the act, adopted in 2021 as Bill 64, that modernized Quebec's private-sector privacy law, the Act respecting the protection of personal information in the private sector. It came into force in three stages, and the CAI enforces it.
22 September 2022
A person in charge of protecting personal information, and the duty to record and report confidentiality incidents.
22 September 2023
Most of the law: published governance policies, stricter consent, privacy impact assessments, destruction or anonymization, transparency about automated decisions, and the new penalties.
22 September 2024
The right to data portability.
Does it apply to your brokerage?
There is no small-business exemption. A one-person brokerage in Quebec that keeps client names, addresses, dates of birth, driving records or claims history is holding personal information in the course of carrying on an enterprise, which is what the law covers.
A brokerage based in another province that serves clients in Quebec should not assume it is outside the law. Whether and how it applies to you is a question for counsel; the practical starting point is to treat your Quebec clients' records to the Law 25 standard.
What it asks of a brokerage
- Name a person in charge. By default it is the person with the highest authority in the business. The role can be delegated in writing, and the person's title and contact details must be published on your website.
- Keep an incident register. Every confidentiality incident is recorded. Where an incident presents a risk of serious injury, the CAI and the people affected must be notified.
- Publish how you handle personal information. Governance policies and practices in plain language, and a privacy policy wherever you collect information through technology, such as a web quote form.
- Get consent that stands up. Consent must be clear, free and informed, given for specific purposes, and requested for each purpose separately from other information.
- Assess before you build or send data out of Quebec. A privacy impact assessment is required for a project to acquire, develop or overhaul a system that handles personal information, and before personal information is communicated outside Quebec.
- Say when a decision is automated. If a decision about a person is based exclusively on automated processing, they must be told, and on request given the reasons and a chance to have a person review it.
- Answer access, correction and portability requests. Since September 2024 a person can ask for computerized information they provided in a structured, commonly used format.
- Destroy or anonymize when you are done. Once the purpose for which information was collected is fulfilled, it is destroyed or anonymized, subject to any retention period another law sets.
What is at stake
The law provides administrative monetary penalties of up to $10 million or 2% of worldwide turnover, and penal fines of up to $25 million or 4%. Those ceilings are written for large enterprises; for a small brokerage the practical risks are a reportable incident you were not ready for and a client request you cannot answer.
Where your CRM comes into it
A CRM does not make a brokerage compliant with Law 25. It is, though, where most of the personal information sits, so five of the obligations above turn into questions for whoever supplies it.
1. Where is the data stored, and who processes it elsewhere?
You need the list of service providers and their locations to do the assessment for information leaving Quebec.
2. Does anything decide about a client without a person?
A score that a broker reads and acts on is decision support. A system that declines, prices or cancels on its own is an automated decision, with the duties that follow.
3. Can you get one client's record out?
Access and portability requests are answered from an export, in a format the client can use.
4. Can you delete a client's record?
Destruction has to be possible in practice, including in backups after their retention window.
5. Who can see what, and will the vendor tell you about an incident?
Access limited by role, and a commitment to notify you promptly, are what let you keep your own register and meet your own deadlines.
What CovioIQ does, and does not do
CovioIQ is built around PIPEDA and Quebec's Law 25, and holds no certification under either. The facts that bear on the five questions:
- Client and policy records are stored in Canada, in Montréal (AWS ca-central-1). Some service providers process limited data outside Canada, including the AI model provider for the optional Alex assistant; each one, what it receives and where is on the Subprocessors page.
- Churn-risk and lead scores are transparent rule sets with the reasons shown beside each score. They rank who to call; they do not decline, price or cancel anything.
- Clients and policies export to CSV whenever you want, and your account and its data can be deleted from Settings.
- Access is limited by role, and each brokerage's records are separated at the database level.
- Your privacy officer, incident register, consent wording, impact assessments and published policies remain yours to do. CovioIQ does not supply them.
Common questions
- Does Law 25 apply to a small insurance brokerage?
- Yes. The law applies to any enterprise that holds personal information in Quebec, with no exemption based on size. What scales with size is the effort, not the obligation.
- Does client data have to stay in Quebec?
- Law 25 does not forbid sending personal information outside Quebec. It requires a privacy impact assessment first, and that the information receive adequate protection where it goes.
- Is a churn-risk score an automated decision under Law 25?
- The duty applies to decisions based exclusively on automated processing. A score that a broker reads before deciding what to do is not, on its face, such a decision; a renewal declined by software with nobody involved would be. If you are unsure which you have, ask counsel.
See where your records would live
The Subprocessors page lists every provider and location, and the security page sets out the controls. Read both before you decide.
Related: PIPEDA and Law 25 for a broker CRM, getting client data out of a system.