Governance policy (Québec)

Québec's Law 25 (section 3.2 of the private sector act) asks companies to publish, in clear and simple terms, the policies and practices that frame how they govern personal information. Privacyboard writes this document for you.

#When it appears

This document is offered to companies established in Canada: it appears in your documents once Canada is selected as the country of your company profile.

#What it contains

• the person in charge of the protection of personal information, and their contact;
• roles and responsibilities of employees and service providers;
• collection and use, with your purposes from the processing register;
• retention and destruction, from your profile;
• security measures;
• privacy impact assessments, for new systems and before data leaves Québec;
• confidentiality incidents and the incident register;
• requests and complaints, answered within 30 days;
• training, and the yearly review.

#Before you validate

Name the person in charge (by default, the highest-ranking person in your company) as your data protection officer in the company profile, and complete the parts in brackets, such as training. Then validate it and choose to show it in your privacy center, at /governance-policy.

#FAQ

#I am in Canada but outside Québec. Do I need it?

The requirement comes from Québec's law. Privacyboard offers it to companies established in Canada, since many serve people in Québec. You can leave it unpublished if no one in Québec uses your service.

#Is it the same as my privacy policy?

No. The privacy policy tells people what you do with their data. The governance policy describes how your company organises itself to protect it: roles, retention, incidents, complaints and training.