Law 25 — Privacy Impact Assessment

Overview

Draft a PIA under Quebec Law 25 for communication of personal information outside Quebec (s. 17). Covers four factors (sensitivity, purposes, protection measures, legal framework), adequate protection conclusion, and written agreement considerations.

Getting Started

Add your source materials to the project workspace, then activate the Law 25 — Privacy Impact Assessment skill. The agent will guide you through the process step by step.

Example conversation

You: We’re about to send customer data to a processor in the US. We need the PIA required under Law 25 before we do that.

Agent: I’ll draft the PIA for the cross-border communication under section 17. I’ll load the Law 25 PIA requirements and use the outline template. I need: categories of personal information, purposes of the transfer, the US recipient and any safeguards (e.g. contract, SCCs), and a summary of the US legal framework for privacy. I’ll document the four factors (sensitivity, purposes, protection measures, legal framework), conclude whether the information would receive adequate protection, and note what should go in the written agreement. Then I’ll run the validation tool to ensure all four factors and the conclusion are present.

Output excerpt

PIA — Adequacy conclusion (excerpt)
4. Adequacy conclusion
Based on the four factors above: The assessment establishes that the information would receive adequate protection, particularly in light of generally recognized principles regarding the protection of personal information. Communication may proceed subject to a written agreement that reflects the assessment and includes [e.g. standard contractual clauses, sub-processor restrictions, audit rights].

5. Written agreement considerations
The written agreement must take into account the results of this assessment and include terms agreed upon to mitigate identified risks (e.g. specific security obligations, return/destruction at end of contract).

References and validation

• references/law25-pia-requirements.md — Section 17 (communication outside Quebec); four factors (sensitivity, purposes, protection measures, legal framework); adequate protection and written agreement; study/research/statistics; EN/FR term glossary.
• assets/pia-outline-law25.md — Template for PIA sections (context, flows, four factors, conclusion, agreement terms).
• validate_law25_pia — Checks the PIA document for: sensitivity of the information, purposes for which it will be used, protection measures (including contractual), legal framework in the destination state, and adequacy conclusion. Reports missing elements. Use after drafting the PIA to ensure a complete section 17 assessment.