Legal bases for processing personal information in Quebec

The Act Respecting the Protection of Personal Information in the Private Sector, as amended by the Act to modernise legislative provisions as regards the protection of personal information (together the "Private Sector Act"), governs the collection, use and communication of personal information in Quebec.

The Private Sector Act presents a complex consent framework that can be challenging to navigate. The Commission d'accès à l'information, Quebec's privacy commissioner, recently published guidelines to help organizations understand these intricacies. An unofficial English translation of these guidelines may be found here.

Based on these recent guidelines, and requirements under the Private Sector Act, we created the below flow chart to help you determine what kind of consent you need, if any, to collect, use and/or communicate personal information.

Download the flowchart

If you have additional questions regarding consent or other obligations under the Private Sector Act, contact our Cyber Security and Data Protection Group.