Law 25 for Quebec real estate brokers
What Quebec's Law 25 asks of a real estate broker, taken from the privacy regulator's own summary, and the questions it raises about your CRM.
What Quebec’s privacy law asks of a business that holds client information, what that looks like in a brokerage, and the questions it should make you ask about your CRM. General information, not legal advice.
Short answer
Law 25 updated Quebec’s private-sector privacy Act in three stages, in September 2022, 2023 and 2024. A business that holds personal information must name a person in charge, publish its privacy practices, ask for consent purpose by purpose, assess the privacy impact before sending information outside Quebec or adopting a new system, keep a register of incidents, and hand a person their data in a usable format on request.
What the law requires
The penalties
The Commission can impose administrative monetary penalties on businesses that contravene the private-sector Act. Its summary gives the example that these could reach 2% of worldwide turnover or 10 million dollars. Those are ceilings. A business that has contravened the Act can also give the Commission an undertaking to remedy it.
Seven questions to ask any CRM vendor
A CRM holds most of the personal information a broker collects, so it sits in the middle of the assessment. These are worth asking in writing:
How Realtor Desk answers them
- The production database and file storage run in Canada, in the ca-central-1 region.
- Some features send content to outside providers, such as SMS delivery, email delivery and the drafting assistant, and those providers may process it outside Canada. Your assessment should cover that.
- The date and source of consent are recorded for each contact, and a message is refused when no consent is on record.
- You can export your data from Settings, and delete a contact.
- The lead score is rule-based and the record shows how each part contributed. A score built from a contact’s engagement may fall within what the Act calls profiling, so decide with your advisor what you tell clients.
- Nothing is sent to a contact without you.
- The interface and client email work in French, set per contact.
What it does not do: carry out your assessment, write your privacy policy, name your person in charge or keep your incident register. We hold no security certification and do not claim one. More detail is on the privacy page .
Questions
Related
- CASL for real estate email , the federal anti-spam law, which applies in Quebec as well.
- The implied consent calculator , for working out when you can no longer rely on an inquiry.
- Bilingual workflows in Realtor Desk.
A CRM hosted in Canada, in French and English
14-day trial; a card is collected up front and nothing is charged before day 14. Then CAD $149 a month for one agent.
A person in charge
The person with the highest authority in the business is responsible for protecting personal information and can delegate the role in writing. The title and contact details must be published on the business's website.
If you work under an agency, ask who holds the role. If you run your own, it is you until you delegate it.
Governance policies
A business must set and apply policies and practices covering retention and destruction, staff roles and responsibilities, and a process for complaints, and publish detailed information about them.
Write down how long you keep client files, who can open them and how a client complains.
A privacy policy
A business that collects personal information by technological means must publish a privacy policy in clear and simple terms and give notice when it changes.
A lead form on your website is collection by technological means.
Transparency at collection
Since September 2023, when collecting, a business must state the purposes, the means, the rights of access and rectification, the right to withdraw consent, the third parties involved, and whether the information may be communicated outside Quebec.
Check that your forms and your first conversation with a client cover each point.
Since September 2023, consent must be requested for each purpose in clear and simple terms. A written request has to be presented separately from other information. Information cannot be used for another purpose without consent, subject to exceptions.
Agreeing to be contacted about one listing is not agreeing to a newsletter. Ask for each.
Privacy impact assessment
An assessment is required before communicating personal information outside Quebec (since September 2023) and for any project to acquire, develop or overhaul an information system that involves personal information. It is proportionate to the sensitivity and quantity of the information.
Choosing a new CRM is the kind of project the rule describes. Ask where the vendor stores and processes data.
Confidentiality incidents
A business must notify the Commission and the people concerned of an incident that presents a risk of serious injury, and keep a register of incidents.
A lost laptop or an email sent to the wrong client goes in the register, even when no notice is needed.
Profiling and identification
A business that collects information using technology able to identify, locate or profile a person must say so beforehand and explain how those functions are activated. They cannot be on by default.
Ask your vendors whether any tool scores or tracks contacts, and what you need to tell clients about it.
Automated decisions
A person must be told when a decision about them is based exclusively on automated processing, and be given the chance to present observations to a member of staff who can review it.
Keep a person in every decision that affects a client.
Since 22 September 2024, on request, a business must give a person the computerised personal information collected from them in a structured, commonly used technological format.
Check that you can export one client's record from your CRM.
In which country and region is the database hosted?
Which outside providers receive client data, for what, and where do they process it?
Can I export one person's record in a structured format, and all my data if I leave?
Can I delete a contact, and what happens to backups?
How and how fast will you tell me about a confidentiality incident?
Does the product score, track or profile contacts, and can I see how?
Is anything sent to a contact without a person approving it?
What is Law 25 in Quebec?
Law 25 is the common name for the Quebec statute, adopted in 2021, that modernised the province's privacy laws, including the Act respecting the protection of personal information in the private sector. Its changes came into force in stages in September 2022, September 2023 and September 2024.
Does Law 25 apply to real estate brokers?
The private-sector Act makes any person who carries on an enterprise responsible for the personal information they hold. A broker or agency that keeps client names, contact details and financial information holds personal information. How the duties are shared between a broker and an agency is a question for your agency or a privacy lawyer.
Is Law 25 the same as PIPEDA?
No. PIPEDA is the federal private-sector privacy law. Law 25 amended Quebec's own Act, which generally governs how a business handles personal information inside Quebec. A Quebec broker who also works across provincial borders may need to consider both.
Can I keep client data in a CRM hosted outside Quebec?
The law does not forbid it, but an assessment comes first. Since September 2023 a privacy impact assessment is required before personal information is communicated outside Quebec. The transfer can go ahead if the assessment shows the information would be adequately protected, and it must be covered by a written agreement.
What are the penalties under Law 25?
The Commission d'accès à l'information can impose administrative monetary penalties on businesses that contravene the private-sector Act. The Commission's own summary gives the example that these could reach 2% of worldwide turnover or 10 million dollars. Those are ceilings, not typical amounts.
Does using Realtor Desk make me compliant with Law 25?
No. Software cannot make a business compliant. Realtor Desk hosts its database in Canada, records the date and source of consent for each contact and lets you export your data. The assessment, the policies, the person in charge and the incident register remain yours.