Privacy impact assessment before communicating personal information outside Québec

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 22 September 2023.

A cross border transfer rule binding private bodies.

As of 24 September 2026.

What it requires

Before communicating personal information outside Québec, or having a person or body outside Québec collect, use, communicate or keep it on your behalf, conduct a privacy impact assessment covering the information's sensitivity, its intended use, available protection measures including contractual ones, and the destination's legal framework.
Put the communication under a written agreement that reflects the assessment's results and any terms agreed to mitigate the risks it identified.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Before communicating personal information outside Québec, or entrusting a person or body outside Québec with collecting, using, communicating or keeping personal information on its behalf, a person carrying on an enterprise must conduct a privacy impact assessment weighing the sensitivity of the information, the purposes for which it will be used, the protection measures that would apply including contractual ones, and the legal framework applicable in the destination jurisdiction.

The communication must be the subject of a written agreement reflecting the assessment's results and any risk-mitigation terms. This duty does not reach personal information that is public by law.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_voice
processes_biometrics
operates_social_platform
serves_minors
operates_app_store
ships_mobile_app
aggregates_content

Read the law

official consolidated statute text, LégisQuébec (Éditeur officiel du Québec)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app