Law 25 and HR: eight checks for employee records

An employee record sits in the HR system, a copy travels through email and an older version remains in a manager’s shared folder. Someone changes roles, but nobody reviews their access. Privacy risk often begins with these ordinary gaps in everyday work.

Law 25 and HR meet in the decisions your business makes about employee information. For a Quebec small business governed by Quebec’s private-sector privacy framework, the practical challenge is to connect ownership, collection, access and retention. This guide offers eight checkpoints and a fictional example to help you start a review with your privacy officer. Legal reference points come from Quebec’s Commission d’accès à l’information (CAI), consulted on October 19, 2026. The workflow is a management tool, rather than a legal assessment of your circumstances. Other requirements may apply to particular records, activities or employers and should be examined with qualified advisers.

Law 25 and HR: identify the information behind the process

Law 25 modernized Quebec’s privacy framework. Personal information relates to an individual and makes it possible to identify them directly or indirectly. A performance note attached to an employee can therefore matter to your inventory just as much as a hiring form. CAI reference: what personal information means (French).

Start by following an actual process: recruitment, onboarding, performance discussions or departure. Where does information enter? Who uses it? Does an export create another copy? Walking through the work often reveals a different picture from the official process diagram.

Avoid treating the entire employee file as one access decision. A supervisor may need an agreed development action without needing every document held by HR. Breaking the process into specific work needs makes access discussions more precise and easier to explain to employees.

Four checkpoints for ownership, collection and access

1. Confirm the privacy officer and the operational contact. The CAI explains that the person with the highest authority holds the privacy officer function by default; delegation must be written. The officer’s title and contact details must be made public as required. Source: business responsibilities (French). Also identify who receives an HR question and who covers that person’s absence. Make the route usable for a new employee.

2. Map categories of records and their copies. List storage locations, tools, copy holders and service providers. Use categories and fictional examples in the workshop instead of circulating real employee files to demonstrate the problem. Give each issue an owner, an expected next step and a review date. Distinguish the official record from a working copy so people know where to look for an approved version.

3. Explain why each collection is necessary. The CAI says businesses must limit collection to information necessary for defined purposes. Consent does not turn an unnecessary collection into a necessary one. Source: collecting personal information (French). For every field, describe the decision or action it supports. If the answer is unclear, bring the field forward for review rather than keeping it because it has always been there.

4. Connect access to an actual function. Internal access must be limited to authorized people who need the information to perform their duties. Source: use and disclosure (French). Build a small matrix: information category, role, work need, permitted access and approver. Examine temporary coverage, transfers and departures separately. A job title alone does not explain every information need within that job.

Four checkpoints for retention, incidents and providers

5. Set retention rules by record category. When purposes are fulfilled, secure destruction or another legally permitted approach must be considered alongside statutory retention requirements. The CAI recommends a retention schedule that respects applicable law. Source: retention and destruction (French). Avoid one expiry date for every HR document. Validate the rules before deletion, including how working copies and backups are handled. Ask qualified people to resolve conflicting requirements rather than asking managers to guess.

6. Make incident reporting easy to follow. Sending information to the wrong recipient can be a confidentiality incident. Businesses must reduce risks, assess harm and record all incidents. A risk of serious injury triggers notification duties to the CAI and affected individuals, subject to statutory exceptions. Source: confidentiality incidents (French). Post a clear internal contact and rehearse the reporting route using a fictional situation. People should know where to start before something happens.

7. Review providers before moving records. The CAI identifies privacy impact assessment requirements for projects involving the acquisition, development or redesign of information systems handling personal information, and before disclosure outside Quebec. Source: changes introduced by Law 25 (French). Ask about processing locations, subcontractors, assistance arrangements and data return conditions. Hosting location alone cannot answer all of these questions. Assign the review early enough for its findings to shape the implementation.

8. Test the process with managers. Choose an arrival, a temporary replacement and a departure. Ask participants to describe the steps and the people they would contact. Record gaps and arrange a follow-up. This exercise tests whether the workflow is understood; it does not certify compliance. Keep the discussion practical enough that someone can repeat the correct action during a busy workday.

A fictional example: clarify access before cleaning up files

In a fictional Sherbrooke business, an HR lead discovers that a former supervisor still has access to a folder of performance reviews after transferring to another role. The team avoids treating this as an informal housekeeping task. It refers the situation to the privacy officer to determine the necessary checks and measures.

The team then separates operational follow-up from access to the full employee record. The new supervisor receives information relevant to the work under validated access arrangements. Existing copies are reviewed through an agreed process, preserving material needed to understand and address the situation.

Finally, the team adds an access review to its role-change workflow. It selects a simple internal measure: each reported transfer has an assigned access reviewer and a recorded completion decision. That measure shows whether an operational step was handled. It does not prove that every privacy requirement has been met. This example illustrates a proposed approach, rather than a customer result or a compliance finding.

Where M360 Compass can support clearer management

M360 Compass is a people management operating system for small and medium-sized businesses. It connects responsibilities, objectives, actions and follow-ups. RoleAlign supports documented management responsibilities, helping teams identify who owns a review action or a follow-up conversation.

Performance and individual development plan capabilities also connect feedback with skills, development priorities and follow-ups. Apply the same discipline to performance review documentation: known expectations, useful observations and clearly assigned actions. More documentation is not automatically better documentation. Choose what supports the work and have appropriate people review sensitive information and unusual situations.

Before implementation, examine M360 Compass privacy reference points and request a demonstration of the permissions available in your configuration. Review the technical and contractual arrangements against your requirements. A platform can support sound practice without taking over the employer’s obligations. Clear management ownership remains part of the implementation, alongside the technology and professional advice your situation requires.

Questions business owners and HR leads ask

Which employee information belongs in the inventory?

Start with recruitment, employment and follow-up records that identify a person. Include secondary locations such as email, exports and shared folders. Ask your privacy officer to examine special cases rather than assuming every record needs the same treatment.

Who should coordinate a small business review?

Choose someone who understands the work and can bring the right people together. Separate practical coordination from the legal privacy officer function. Allocate time, a backup contact and a way to resolve decisions that cross departments.

What if someone emails a file to the wrong recipient?

Report it promptly through the agreed internal route. Record what is known without forwarding the file again. Involve the privacy officer in evaluating the situation and determining the measures required by the circumstances.

Does Canadian hosting guarantee compliance?

No. Access, purposes, providers and other processing arrangements also need examination. Verify the requirements relevant to your organization instead of treating a single hosting characteristic as a complete privacy assessment.

Start with one process and one concrete question: who needs which information for which task? To explore clearer responsibilities and more consistent follow-ups, request a demonstration of M360 Compass.