IT services in Quebec: a practical compliance checklist
An IT services business handles sensitive information: client contact details, descriptions of IT environments, ticket histories. This checklist turns the rules that apply in Quebec into concrete actions, with the official source for each. It is general information, not legal advice: have your situation validated by your legal adviser.
1. Personal information: Law 25
In Quebec, the personal information you collect, whether client contacts, requests or tickets, is protected. The Act respecting the protection of personal information in the private sector applies to businesses that collect, use or communicate it, including the information of your clients' contacts. Your privacy policy, retention and consent should be validated with your legal adviser.
In how Neo, the Orvel agent, works, only the fields useful to the service are collected: name, contact details, company, need. The IT environment field is flagged as sensitive, access is limited to the team and deletion happens on request.
- Collect only what is needed to answer the request.
- Have your privacy policy and retention periods validated.
- Have the consent shown on your forms validated.
- Limit access to files to your team and plan for deletion on request.
- Official source: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/ and https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1.
2. Your clients' data stays with your clients
Passwords, access keys and system contents have no place in the tracking tool. Neo has no access to the servers, accounts or data of your clients: he reads only what you put in your tracking tool and in your ticketing system.
Your managed services contracts often include confidentiality and security clauses: your team and your legal adviser remain responsible for complying with them, and Neo does not interpret them. The client file carries only a summary of the IT environment, and there is no password field.
- Check that nobody pastes a password or access credential into a note or a ticket.
- Stick to a summary of the environment: workstations, servers, network.
- Have your legal adviser validate the clauses of your contracts.
- Source: https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1.
3. Privacy incident: a person, right away
Quebec law sets out obligations in the event of a privacy incident, including keeping a register. A client who believes they have been hacked, or exposed data, falls into this category. Have your legal adviser validate your internal procedure: who applies it and in what order.
Neo never classifies an incident. If he hears of one, he hands off to your team without delay and keeps the conversation in the file. He also makes no technical diagnosis: he opens the ticket and a technician takes over.
- Write the procedure: who is notified, who classifies, who records.
- Name an on-call person who receives these handoffs.
- Keep the conversation in the file as it happened.
- Source: https://www.cai.gouv.qc.ca/protection-renseignements-personnels/.
4. Commercial emails and texts: consent and unsubscribing
Canada's anti-spam legislation (CASL, known in French as LCAP) governs commercial electronic messages. It generally requires consent, sender identification and an unsubscribe mechanism, with certain exceptions. Which messages require consent should be validated by your legal adviser.
In Neo's case, renewal reminders, backup reminders and add-on offers are sent according to your rules, with an unsubscribe link. The message templates repeat it at the bottom of the email.
- Check consent before any reminder or offer.
- Clearly identify your business as the sender.
- Include an unsubscribe link and honour removals.
- Sources: https://crtc.gc.ca/fra/internet/anti.htm and https://laws-lois.justice.gc.ca/fra/lois/E-1.6/.
5. Promises: nothing outside your rules
An agent that answers clients must stay within the limits you set. Neo promises no price, lead time or service level outside your rules. Announced lead times follow the contract's service level, and cases outside the framework go to a person.
Check that your rules describe, for each service level (no contract, as needed, basic support, extended support, fully managed services), what may be said to the client. This avoids expectations your team could not meet.
Four reflexes sum up this list: collect little, never store access credentials, hand incidents to a person and respect consent. Neo applies them in his daily work, and your legal adviser validates the whole.
General information, not legal advice. Check with your professional order or the official source.
Questions
Is this list legal advice?
No. It is general information drawn from official sources. For your privacy policy, your contracts and your incident procedure, consult your legal adviser.
Can Neo look at a client's servers to handle an incident?
No. He has no access to your clients' systems, accounts or data. If he hears of an incident, he hands off to your team.
Can a renewal reminder be sent without consent?
The anti-spam law generally provides for consent, identification and unsubscribing, with certain exceptions. Have your legal adviser confirm which messages require consent.
More guides for this trade
Let's talk for 15 minutes?
A Zenitech expert will call you back within 24 hours to see what Orvel can do in your day. No obligation.