This is the requirement that catches most Quebec small businesses off guard, because it kicks in without anything being “sent” in the usual sense. Storing your HR files in a cloud service whose servers are located outside Quebec is enough to trigger it.
This page explains what Section 17 requires, why hosting counts as a disclosure, and how to produce a useful assessment without spending weeks on it.
Quick answer: Before disclosing personal information outside Quebec, or entrusting its processing or storage to a person or organization outside Quebec, the company must conduct a privacy impact assessment and enter into a written agreement. The law says “outside Quebec,” not “outside Canada”: hosting in Ontario is covered.
1. What Section 17 Says
Before disclosing personal information outside Quebec, a company must conduct a privacy impact assessment. The assessment must specifically account for four elements:
- the sensitivity of the information;
- the purpose of its use;
- the protection measures, including contractual ones, that the information would benefit from;
- the legal regime applicable in the jurisdiction where the information would be disclosed, in particular the personal information protection principles in force there.
The disclosure may proceed if the assessment demonstrates that the information would benefit from adequate protection, in particular with respect to generally recognized personal information protection principles. It must be the subject of a written agreement that reflects the results of the assessment and, where applicable, the agreed-upon terms for mitigating the identified risks.
2. The Catch: Hosting Counts as a Disclosure
The fourth paragraph of Section 17 is the one that catches almost every small business. It applies the same rules when a company entrusts a person or organization outside Quebec with the task of collecting, using, disclosing, or retaining personal information on its behalf.
There is no need to transmit anything in the usual sense. Outsourcing your payroll to a provider that processes it in Ontario triggers Section 17. Using an overseas call center does too. Hosting your files in a cloud service whose servers are outside Quebec does too.
Note also that the law says “outside Quebec,” not “outside Canada.” A transfer to Ontario or Alberta is subject to the same rules as a transfer to a foreign country. This is the detail that surprises business leaders most, because it covers providers they would naturally consider local.
3. What This Means for a Typical Small Business
Take stock of your vendors that handle personal information. The list is almost always longer than expected:
- office suite and email;
- payroll and HR management;
- CRM and billing platform;
- email marketing tool, ticketing or reservation system;
- e-signature tool, survey platform;
- applicant tracking system;
- website hosting, backup service, chat tool;
- AI provider.
For each one: what data, what purpose, where are the servers, what contract, what protection clauses. Many large vendors publish contractual commitments and document where data is stored. That makes the assessment easier, but it doesn’t replace it. You are the one who must produce and retain the assessment, not them.
4. One Assessment Per Service, Not Per Country
A common mistake is concluding once and for all that a given country is acceptable. Section 17 requires an assessment that accounts for sensitivity and purpose, meaning the specific service in question.
An email marketing tool that holds a first name and email address does not carry the same risk as a platform that holds employee medical records. The same country may be acceptable for the first and not for the second.
Treat it as a one-page sheet per service, to be reviewed when the service changes or when the contract is renewed. A useful sheet includes the service and its use, the contracting entity, the categories of information entrusted, the sensitivity, the location of data at rest and in backup, the reference to the written agreement, the provider’s sub-processors, the deletion mechanism at the end of the contract, and the next review date.
5. The AI Connection
This is now the most common source of undocumented transfers in a small business.
An employee pastes an excerpt from a client file into a general-purpose AI tool. The content goes to a service whose servers are outside Quebec, without an assessment, without a written agreement, often under terms of service that allow the submitted content to be retained.
Two concrete steps. Decide which tools are authorized and put it in writing. Then make sure the chosen service is covered by a corporate contract rather than consumer terms of service, because the commitments are not the same.
6. What Falls Under Your IT Provider
The assessment is a document, but it rests on technical facts that only the infrastructure can provide: which services are actually in use at the company, where data is stored and backed up, which connectors export what to outside systems, and which accounts have access.
An up-to-date technical inventory turns Section 17 into a few-hours exercise per service. Without it, you assess the vendors you remember and miss the ones a department added on its own. Our managed IT services produce that inventory and track its evolution.
Frequently Asked Questions
Is hosting in Ontario a transfer outside Quebec?
Yes. Section 17 covers disclosures outside Quebec, not outside Canada. An assessment and a written agreement are required even for a Canadian provider in another province.
Can the provider do the assessment for us?
No. The obligation belongs to the company disclosing the information. The provider can supply documentation about data location and its contractual commitments, but the assessment and its retention remain on your side.
Is the assessment done per provider or per service?
Per service. A single provider may offer several services with very different risk profiles. The assessment accounts for sensitivity and purpose, so it is done at the level of the service being used.
Documenting Your Transfers, from Trois-Rivières
The time-consuming part of Section 17 is not the writing, it’s knowing who holds what and where. Our IT services for small businesses include vendor inventory, data flow mapping, and the technical documentation that feeds your assessments, for companies in Mauricie and across Quebec. To get started, use the contact form or call 450-231-3836.
This guide simplifies legal obligations. It is not legal advice and does not replace reading the actual legislation or consulting a legal professional. Legal references point to the Act Respecting the Protection of Personal Information in the Private Sector (CQLR, chapter P-39.1), as amended by Law 25.