Quebec Bill 25 and online training: what Canadian training providers need to know

Since September 2024, Bill 25 (the modernized Quebec Act respecting the protection of personal information in the private sector) applies in full to organizations that collect data through their training platforms. Here is what you actually need to do — not the theory, the checklist.

1. Who is affected?

Any organization that processes personal data from learners located in Quebec — regardless of size. A solo consultant with 10 trainees per month is just as concerned as a 200-employee SMB. Penalties go up to CA$25M or 4% of worldwide turnover.

2. The 5 obligations that apply to you

1. Appoint a Person in Charge of the Protection of Personal Information (the equivalent of a DPO). It is your name plus an email address, published on your website. You do not need to hire anyone.
2. Keep a register of processing activities. An internal document that lists which data you collect, why, who has access, and how long you retain it.
3. Obtain explicit, separate consent for each purpose. A single "I agree to the Terms" checkbox covering five different processing activities is no longer valid.
4. Privacy Impact Assessment (PIA) for any new system that processes sensitive data (health, biometrics, etc.).
5. Notify the CAI (Commission d'accès à l'information) in case of a confidentiality incident presenting a serious risk of harm, in the shortest delay possible.

3. Hosting: Canada or somewhere else?

Bill 25 does not ban transfers outside of Canada — it requires an assessment and clear notice to the learner. But in practice, your B2B clients (large groups, government bodies, accredited training providers) will systematically demand Canadian hosting in Canada Central to avoid the legal back-and-forth.

If you use an American platform like Synthesia or HeyGen, data flows through the United States — you must document this and collect explicit consent from every learner. It is a frequent commercial blocker.

4. Data minimization by default

Bill 25 introduces the principle of minimization: you must only collect what is strictly necessary. For a training module, that means:

• Learner email: yes (needed for the access link)
• Full name: yes if you issue a certificate
• Date of birth, address, Social Insurance Number: never, unless a clear regulatory justification applies
• Progression data (time spent, slides viewed): yes, but explained in your privacy notice

5. Right to portability and erasure

A learner can at any time request:

• An export of their data (structured, machine-readable format)
• Deletion of their account and all related interactions

You must respond within 30 days. A modern platform offers both functions as self-serve actions inside the learner workspace.

6. The Q&A consent: a trap often missed

If your platform offers voice Q&A (the learner speaks, the AI transcribes and replies), you are processing biometric data (the voice itself). That requires a separate, explicit consent. Beyond compliance, this is also a commercial argument — clearly stating that voices are never used to train a public model reassures HR buyers.

7. Documents to prepare

• Privacy policy published on your website (page /trust or /legal)
• Register of processing activities (the CAI Quebec template is freely available)
• DPA (Data Processing Agreement) signed with every subprocessor (your LMS, your AI platform, your analytics provider)
• Internal procedure for handling access requests (export plus deletion)

Summary

Bill 25 does not make online-training production harder — it just requires you to be explicit about what you collect and why. Choosing a platform that natively hosts in Canada (Docentia Enterprise on Azure Canada Central) removes 80% of the legal back-and-forth in one move. The rest is documentation discipline.

Need a Bill 25 starter kit? Ask us for the register template and the DPA — we send it free, ready to sign.