Privacy impact assessment Quebec: the $0 walkthrough for Law 25

Quebec's Commission d'accès à l'information (CAI) fields thousands of complaints and inquiries every year, and a meaningful share involve how organizations handle personal information when they adopt new software. A privacy impact assessment, or PIA, is the document Law 25 requires before that adoption happens. It sounds like the kind of thing that needs a lawyer. Mostly, it does not, and a privacy impact assessment Quebec businesses can produce in-house is realistic for most ordinary software purchases.

This is a walkthrough for the office manager or owner who has to produce one before turning on a new customer database, a marketing tool, or an AI platform that stores conversations and documents. No consultant, no $4,000 invoice. Just the sections a real PIA needs, in order, and the questions a business actually has to answer. Nothing here is legal advice; treat it as a starting structure and confirm edge cases with a qualified privacy lawyer or the CAI.

What Law 25 Small Business Owners Actually Have to Do

Quebec's Act respecting the protection of personal information in the private sector, the law everyone calls Law 25, requires a business under section 3.3 to conduct a privacy impact assessment before any project to acquire, develop, or overhaul an information system or electronic service delivery involving personal information. It also applies before sending personal data outside Quebec.

The wording is broad enough to cover a lot: a new CRM, a scheduling app that stores client phone numbers, an AI chat tool used to draft client emails if it retains those emails. It does not cover every software purchase. A static website redesign with no data collection generally would not trigger it. But the threshold is lower than most owners assume, and the CAI's public materials suggest what the project does, rather than the size of the company doing it, determines whether the obligation applies. Businesses working through related questions, like whether a given data collection needs fresh consent, can see how these obligations connect in the consent question small businesses keep getting wrong.

There is no prescribed template in the statute itself. The CAI's own self-assessment guide is the closest thing to an official form, and it asks for five things: a project description, an inventory of personal information involved, a risk analysis, the mitigation measures in place, and a decision, signed by someone with actual authority, on whether the project proceeds.

Penalties for getting this wrong are not trivial. Law 25 section 102 sets administrative monetary penalties at up to $25 million or 4% of worldwide turnover, whichever is greater, for the most serious violations, with separate penal provisions that can run higher still for repeat or egregious cases. Most enforcement to date has favoured compliance orders over maximum fines for small operators, but the ceiling is real, and it is worth reading alongside the Office of the Privacy Commissioner of Canada's guidance on PIPEDA compliance for businesses operating outside Quebec too.

Building the Document Section by Section

Start with the project description: one paragraph on what the tool is, what it does, why the business is buying it. This section trips people up because they overwrite it. A PIA is a factual record, not a sales pitch.

The information inventory takes the longest, and it should. List every category of personal information the new system will touch: names, emails, phone numbers, payment details, employee records, health information if it applies. For each, note where it comes from, where it is stored, and who inside the business can access it. Employee records deserve particular care here; see employee data and Canadian privacy law: what SMB owners get wrong for the specific traps that trip up this section. If the vendor is a cloud provider, this section also has to note where that vendor stores and processes the information, which is the point at which most businesses discover they do not actually know the answer, because most software vendors bury it three pages into a privacy policy.

Risk analysis comes next, and it does not require actuarial tables. Three questions cover most of it: what happens if this data is breached, what happens if it is used for something other than its stated purpose, and what happens if the vendor itself gets breached or acquired. A four-person accounting firm does not need a Monte Carlo simulation. It needs an honest paragraph on each question.

Mitigation measures follow directly from the risks identified: encryption in transit and at rest, access controls, staff training, a data retention schedule, a breach notification plan. Some of this the business controls directly. Some of it is inherited from the vendor, which is why vendor selection and the PIA are not separate exercises. A broader look at how AI adoption specifically changes these obligations is in AI and your privacy obligations: what changes when your team adopts AI.

The final section is the decision record: who reviewed the assessment, what they decided, and the date. This is the part regulators actually look for if a complaint arrives. A PIA that nobody signed carries no weight if the CAI comes asking.

Where Vendor Choice Changes the Assessment

The vendor picked for any of this, whether CRM, storage, or AI chat, determines how long the risk-analysis section runs. A tool built by a company with an unclear sub-processor list and a privacy policy written for a US audience forces the business to guess, and guessing does not hold up well if the CAI ever asks to see the document.

Augure, a Vancouver-based AI platform built for regulated Canadian organizations, publishes its sub-processor list and stores customer data in Canada, which shortens the inventory and residency sections of a PIA compared with a vendor whose answer requires a follow-up email to legal. Augure's documentation states that inference for most model tiers runs on Canadian infrastructure, with vetted EU partners under zero-data-retention agreements providing certain tiers and failover capacity; limited US processing still applies to payment card networks and email delivery. Businesses should verify current sub-processor lists directly with any vendor before relying on them in a filed PIA, since these arrangements can change. None of this removes the requirement to write the PIA. It means the answer to "where does this data go" fits in one paragraph instead of a support ticket that may never get a reply.

A PIA that nobody signed carries no weight if the CAI comes asking.

Federally, the Personal Information Protection and Electronic Documents Act (PIPEDA) does not use the term "privacy impact assessment" and does not mandate one in Law 25's structured, triggered sense. It does require organizations handling personal information in commercial activity to be accountable for it and to have policies proportionate to the sensitivity of the data, which in practice pushes businesses outside Quebec toward similar documentation even without an explicit PIA clause. A business in Ontario or Alberta adopting the same AI tool as a Quebec business inherits a comparable paper trail problem, just under a softer statutory trigger. The Office of the Privacy Commissioner of Canada publishes its own PIA guidance for federally regulated organizations that is worth reading alongside the CAI's material.

For businesses weighing whether to spend on compliance tooling first or a PIA first, compliance on a budget: where small Canadian firms should spend first lays out a sequencing that generally puts the PIA ahead of paid software.

Cost Comparison, Plainly

A consultant-drafted PIA for a small business typically runs $1,500 to $6,000, based on rates quoted informally by Quebec privacy law boutiques for straightforward single-system assessments; a business should get its own quotes rather than treat this range as fixed. A DIY version using the CAI's own template costs the business its own time, roughly four to six hours for someone who has never written one, less on a second attempt.

The math gets more interesting on the software side. A small business paying US$30 a month per seat for a mainstream AI chat subscription, times five employees, runs over C$2,000 a year before anyone has written a word of compliance documentation, and that subscription still requires the vendor-inventory guesswork described above. Augure's Pro tier, priced at C$20 a month per user for comparable functionality, costs less and answers the residency question on its pricing page rather than in a support queue. Neither figure replaces legal advice for a company handling health records or minors' data, where the CAI has signalled it expects more rigorous assessments. For most small businesses buying ordinary productivity software, the DIY path paired with a Canadian vendor tends to get finished before the deadline instead of sitting in an inbox for three months waiting on a consultant's availability.

Some of these myths run deeper than cost. Five privacy compliance myths costing Canadian small businesses money covers a few assumptions, like believing a signed vendor contract substitutes for a PIA, that lead owners to skip this step entirely.

The unresolved question, one the CAI has not clarified publicly, is how it treats a PIA that predates a vendor's own compliance updates: whether a business has to redo its assessment every time a supplier changes its data-handling terms, or only when the change is material. Businesses are, for now, making that call themselves, and a conservative default, treating material changes like new sub-processors or shifts in data residency as a trigger, is the safer reading until the CAI says otherwise.

Businesses building this documentation from scratch can start with a template in hand rather than a blank page. Augure offers a Canadian-hosted AI workspace that can draft the inventory and risk sections of a PIA directly from a project description, with the sign-off decision left where it belongs, with the business owner.