01 · ContextAn accounting firm is a prime target.
Quebec Law 25 modernizes the Act respecting the protection of personal information in the private sector. It applies to every business that collects, holds, uses, or discloses personal information, regardless of size. An accounting firm handles personal information every single day — and the most sensitive kind:
- Social Insurance Number (SIN)
- Income, T4 and RL-1 slips
- Bank and financial statements
- Medical and prescription receipts
- Dependents & family situation
- Home address & dates of birth
During peak tax season, these sensitive files circulate via unencrypted emails, paper folders, and shared workstations. That is precisely where incidents occur: an attachment emailed to the wrong client, a stolen laptop, or a compromised firm inbox.
CPA professional secrecy is no longer enough. Law 25 mandates active operational governance: a designated privacy officer, published policies, breach registries, privacy impact assessments, and vendor contracts.
02 · TimelineThree phases, all currently in effect.
The legislation came into force progressively between 2022 and 2024. As of September 2024, all statutory obligations are fully enforceable.
September 22, 2022
- Appoint a Person in Charge of Personal Information Protection
- Record and report confidentiality incidents in a mandatory registry
September 22, 2023
- Publish privacy governance policies on the firm website
- Obtain clear, express consent requested separately for defined purposes
- Conduct Privacy Impact Assessments (PIA / EFVP) for systems
- Regulate communication of personal data outside Quebec
- Mandatory data destruction or anonymization · administrative monetary penalties
September 22, 2024
- Right to data portability: provide personal data upon client request in a structured, commonly used technological format
03 · Legal ObligationsThe 8 obligations, translated for accounting firms.
For each obligation: what the statute requires, what it specifically demands from your firm, and where applicable, what ClicBook automates.
- 01 · Sec. 3.1
Appoint a Privacy Officer
The person with highest authority (typically managing partner) is responsible by default. They can delegate this role in writing.
At the firm: Publish the title and contact details of the Privacy Officer on the firm’s website.
- 02 · Sec. 3.2
Adopt & Publish Policies
Clear governance rules on data retention, destruction, staff roles, and complaint handling.
At the firm: Who has access to which client files? How many years do you retain T1 records? Document it clearly and publish it on your website.
- 03 · Sec. 8 & 14
Obtain Explicit Consent
Clients must understand why you collect their data and to whom it is disclosed. Consent must be requested separately for defined purposes.
At the firm: Engagement letters and tax authorizations (CRA, Revenu Québec) must explicitly specify data usage.
Digital signature of engagement letters and tax authorizations directly in the portal.
- 04 · Sec. 3.5 to 3.8
Manage Incidents & Keep a Registry
Unauthorized access, use, disclosure, or loss: you must reduce risk, assess injury, and if serious risk exists, promptly notify the Commission (CAI) and impacted individuals.
At the firm: Maintain a registry of all confidentiality incidents, including minor ones, and retain it for at least 5 years.
File audit trail: know exactly which team member opened which client file, and when.
- 05 · Sec. 3.3
Perform Privacy Impact Assessments (PIA)
A Privacy Impact Assessment (PIA / EFVP) is legally required before acquiring, developing, or overhauling any system that handles personal data.
At the firm: New client portal, new cloud accounting software, new tax AI tool: complete a PIA prior to deployment.
- 06 · Sec. 17
Regulate Data Outside Quebec
Before transferring personal information outside Quebec, a PIA must prove equivalent legal protection, backed by a written contract.
At the firm: Verify where your emails, cloud backup, and tax software servers are physically hosted.
Installed on your own dedicated server: you decide exactly where your data resides.
- 07 · Sec. 18.3
Bind Service Providers by Contract
Any IT vendor or subcontractor handling personal data must sign a written agreement: security measures, purpose limitations, deletion upon termination, incident alerts.
At the firm: Review contracts with your IT providers, software vendors, and external subcontractors.
We have zero access to your client data, and your firm receives full source code.
- 08 · Sec. 23
Destroy or Anonymize on Time
Once the intended purpose is fulfilled, personal information must be safely destroyed or anonymized, subject to statutory retention rules (tax laws).
At the firm: Set defined retention schedules by file type (e.g. 6–7 years for tax returns), then actively purge old records, including paper files.
And your clients’ statutory rights
Your clients are entitled to exercise these legal rights with your firm. You must be prepared to respond promptly in writing.
- Access
- Clients can request and obtain all personal information your firm holds on them.
- Rectification
- Clients can demand correction of inaccurate or incomplete records.
- Data Portability
- Since 2024: personal files must be provided in a structured, commonly used format.
- 30-Day Response
- Your firm has exactly 30 days to answer access and portability requests in writing.
04 · SanctionsStatutory penalties that are no longer symbolic.
Since September 22, 2023, the Commission d’accès à l’information (CAI) can directly impose administrative monetary penalties. Courts can also levy heavy penal fines, and affected individuals may sue for civil and punitive damages.
Up to
$10M
or 2% of worldwide turnover
Administrative Monetary Penalty
Imposed directly by the Commission; the greater amount applies.
Up to
$25M
or 4% of worldwide turnover
Maximum Penal Fine
For corporations; the greater amount applies.
For an accounting firm, the primary business risk isn’t just the maximum fine: it is the immediate destruction of client trust. A client whose SIN has been exposed will not return next tax season, and they will tell their peers.
05 · In PracticeWhere firms struggle in practice, and how ClicBook helps.
Most compliance vulnerabilities stem from rush habits during tax season. The four most common pitfalls:
Today
Clients email T4s and bank statements as unprotected attachments.
With ClicBook
Documents are uploaded through an encrypted portal, secure in transit and at rest.
Today
Everyone has open access to all folders, and no one tracks who opened what.
With ClicBook
Every single file consultation is recorded in an immutable audit log.
Today
A reused password is all it takes to compromise the firm’s email inbox.
With ClicBook
Two-factor authentication enforced, with automatic account lockout upon repeated failures.
Today
You do not know in which country your cloud vendors store client records.
With ClicBook
The platform and database live on a dedicated server under your firm’s name and chosen jurisdiction.
Software alone cannot make a firm fully compliant: the privacy officer, governance policies, and staff training remain your responsibility. However, a platform that encrypts file transfers, records an immutable access audit trail, and keeps data sovereign resolves the vast majority of technical compliance checks.
06 · Action ChecklistCompliance checklist in 12 items.
Check off what your firm has already implemented. No data is stored or transmitted.
Your Firm
0 out of 12 items in place
Frequently Asked Questions
Does Law 25 apply to small accounting firms and solo practitioners?+
Yes. The law applies to any enterprise collecting, holding, using, or communicating personal information, regardless of head count. Solo practitioners preparing personal tax returns are fully subject to it.
Doesn’t CPA professional secrecy already satisfy Law 25?+
No. Professional secrecy governs confidentiality obligations. Law 25 introduces active governance mandates: designated officer, published policies, breach registry, PIAs, and vendor contracts. Both frameworks apply concurrently.
Is an email sent to the wrong client considered an incident?+
Yes: that constitutes unauthorized communication of personal data. You must record it in your incident registry, mitigate the risk (request immediate deletion), and assess the risk of injury. If serious, the Commission (CAI) and the individual must be notified.
Does using compliant software automatically make our firm compliant?+
Not by itself. A compliant tool like ClicBook provides critical technical safeguards (encryption, audit logging, data sovereignty), but appointing a privacy officer, adopting policies, securing consent, and training staff remain the firm’s responsibility.
SourcesOfficial References & Further Reading
- Principaux changements apportés par la Loi 25Commission d’accès à l’information
- Incidents de confidentialité et mesures de sécuritéCommission d’accès à l’information
- Sanctions et poursuites pour les entreprisesCommission d’accès à l’information
- Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ, c. P-39.1)LégisQuébec
- Entrée en vigueur de nouvelles dispositions de la Loi 25 (septembre 2023)Gouvernement du Québec
- Tout ce que vous devez savoir sur la Loi 25FCEI
- Transferts de renseignements personnels hors du QuébecBLG
This article summarizes statutory requirements for general informational purposes and does not constitute formal legal counsel. For specific circumstances, consult a qualified attorney or the Commission d’accès à l’information. Statutory sources last verified: September 29, 2026.