Loi 25 on Azure: residency, deletion and incident evidence

What Law 25 actually requires of an architecture

Law 25 amended Quebec’s private sector privacy act in phases from September 2022 through September 2024. Strip out the governance obligations and what remains is a short list of things your systems must be able to do.

Know where personal information is. Not approximately. Which database, which storage account, which export, which analytics copy, which backup, which supplier. Every other obligation depends on this one, and almost every organization overestimates how well they know.

Justify any communication outside Quebec. Section 17 does not prohibit it. It requires an assessment weighing the sensitivity of the information, the purpose, the protections in place including contractual ones, and the legal framework applicable where it is going. Residency is one way to satisfy that. A written, defensible assessment is another. Vendors who tell you the law forces everything into a Quebec data center are selling a constraint the statute does not impose.

Run a privacy impact assessment where required. An ÉFVP is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and for communications outside Quebec. The assessment is a governance document, but its inputs are architectural.

Produce, correct, and stop using an individual’s information on request. Including de-indexing and cessation of dissemination in defined circumstances, and, since September 2024, portability: the personal information a person provided, in a structured, commonly used technological format.

Delete or anonymize when the purpose is fulfillled. Anonymization has its own regulation, in force since 2024, requiring generally accepted best practices, a documented re-identification risk analysis, and a record of the process. Anonymized is a high bar. Pseudonymized data is still personal information.

Detect and report a confidentiality incident. Promptly to the Commission d’accès à l’information and to affected individuals where there is a risk of serious injury, plus a register of confidentiality incidents retained for five years.

Explain automated decisions. Where a decision is based exclusively on automated processing, the person must be informed and able to make representations. That requires knowing which inputs and which model version produced the decision.

The exposure behind all of this is real: administrative monetary penalties up to 10 million dollars or 2 percent of worldwide turnover, penal fines up to 25 million or 4 percent, and a private right of action with punitive damages of at least 1,000 dollars per person.

What we design and enforce in Azure

A data inventory that is maintained, not authored once. Microsoft Purview for cataloguing and classification, sensitivity labels applied to the categories your privacy notice actually names, and a mandatory data classification tag enforced by Azure Policy so an untagged resource holding personal information cannot be deployed.

Region as policy, with the trade-off made explicitly. An allowed locations assignment at the management group level, so every future subscription inherits it and no one can override it in a hurry. The design decision underneath it is real: Canada East is the region physically located in Quebec, with a narrower service catalog and no availability zones. Canada Central, near Toronto, offers the full catalog and zonal resilience but places the data outside Quebec while keeping it in Canada. We write that choice down with the resilience consequence attached, and it becomes an input to your section 17 assessment rather than an accident discovered during an audit.

Retention and deletion designed rather than improvised. Lifecycle rules on storage, retention set per data category, and a deletion path that has been executed at least once in a test. Backups are the hard part: a deletion request against an immutable backup is a design problem, and it needs an answer before it arrives, not after.

Portability as an endpoint, not a project. An export path producing structured output for a single individual, tested, with the identity verification step defined. Building it under a thirty-day clock is how organizations end up shipping a manual database query.

Detection, and a path from alert to responsable. Microsoft Defender for Cloud for posture, Microsoft Sentinel rules for mass export, anomalous access and credential abuse, and a written escalation path that names who assesses risk of serious injury and who notifies the Commission. The register of confidentiality incidents is built as a durable record, not a shared document.

Identity and access, because most incidents start there. Microsoft Entra ID with Conditional Access and Privileged Identity Management so administrative access is requested and time-bound, scheduled access reviews, and private endpoints removing the public path to systems holding personal information. The same substrate is described on the Azure landing zone page.

Automated decisions you can explain. Where a model influences a decision about a person, the inputs, the model version and the output are logged, so the explanation obligation has a source of truth behind it.

What the evidence pipeline produces

A current inventory of systems holding personal information, with classification and owner.
Azure Policy compliance state for allowed locations, proving where data has actually been permitted to land, with dated history.
The data flow and recipient list that feed each ÉFVP, including suppliers and sub-processors.
Deletion and anonymization execution records, with the re-identification analysis retained.
Portability export logs, showing the request, the verification and the response time.
Access logs on personal information stores, and PIM activation history for anyone with a path to them.
Detection alerts, their triage, and the incident register entries with the five-year retention configured.

What you keep

The data inventory and the classification scheme behind it.
The policy set as code, including the region assignment, in your repository.
An ÉFVP input pack: data flows, categories, recipients, regions, retention, safeguards, ready to hand to whoever writes the assessment.
A written record of the residency decision and the resilience trade-off it carries.
Tested deletion, anonymization and portability procedures with their runbooks.
The incident detection rules, the escalation path, and the register.

Who this is for

Quebec organizations that read Law 25 carefully and realised it describes their architecture rather than their privacy policy. Companies whose Quebec customers or public sector clients now flow these obligations down by contract. Any organization about to build or overhaul a system holding personal information, which triggers the ÉFVP obligation at the point where the architecture is still cheap to change.

Who this is not for

We do not act as your responsable de la protection des renseignements personnels. That is an accountable role inside your organization, held by default by the person with the highest authority and delegable only in writing. We do not write your privacy policy, we do not sign your ÉFVP, and we are not lawyers. We design and build the architecture those documents describe, and we supply the facts they rest on. If what you need is a privacy notice on the website and nothing else, a law firm is a better first call than we are.

Compliance architecture, the engagement that delivers this.
GDPR and HDS, the European equivalent of the transfer question.
SOC 2 on Azure, which shares the access and logging substrate.
Azure landing zone, where region policy is enforced.
Compliance, the pillar.

Questions we get

Does Law 25 require our data to stay in Quebec?

No, and this is the most expensive misunderstanding in the market. Section 17 requires an assessment before personal information is communicated outside Quebec, weighing sensitivity, purpose, the protections in place including contractual ones, and the legal framework of the destination. Residency is one way to answer it. A documented assessment is another.

Which Azure region should we use?

Canada East is the region physically located in Quebec, and it carries a narrower service catalog and no availability zones. Canada Central, near Toronto, has the full catalog and zonal resilience. Many designs keep primary data in Canada East and accept that the paired region is elsewhere in Canada, documented in the assessment. Choosing blind is what creates the problem.

Who has to be the responsable de la protection des renseignements personnels?

By default the person with the highest authority in the organization, who may delegate the role in writing. The title and contact details must be published. We do not fill that role and cannot: it is an accountable position inside your organization, not an outsourced service.

What is an ÉFVP and do we need one?

A privacy impact assessment. It is required for any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information, and for any communication of that information outside Quebec. We supply the architectural facts it depends on: data categories, flows, recipients, regions, retention and safeguards.

How fast do we have to report a confidentiality incident?

Promptly, to the Commission d'accès à l'information and to affected individuals, where the incident presents a risk of serious injury. You must also keep a register of confidentiality incidents and retain it for five years. Reporting promptly is only possible if detection exists, which is where the architecture work concentrates.

What is the actual exposure if we do nothing?

Administrative monetary penalties up to 10 million dollars or 2 percent of worldwide turnover, penal fines up to 25 million dollars or 4 percent, and a private right of action carrying punitive damages of at least 1,000 dollars per person. The Commission publishes its decisions, which is its own kind of exposure.

Have a question about this work?

Three fields. An architect reads it and answers within one business day.