Strict record-keeping obligations are now in force with respect to the anonymization of personal information under Quebec’s private sector and public sector privacy statutes.
This record-keeping requirement is the last obligation to come into force under Quebec's Regulation respecting the anonymization of personal information, which introduced criteria for private sector organizations and public bodies seeking to anonymize personal information records under the respective statutes (section 23 of Quebec’s private sector privacy statute, and section 73 of Quebec’s public sector privacy statute).
As of January 1, 2025, organizations that anonymize personal information are required under these statutes to maintain a register containing the following information:
- a description of the information that was anonymized,
- the purposes for which the anonymized data is intended to be used,
- the anonymization techniques used,
- the security measures implemented to reduce re-identification risks, and
- the date(s) on which the organization conducted a re-identification risk assessment, and any periodic updates to those risk assessments as required under the Regulation.
The Regulation does not specify the retention period applicable to this register.
Additional information on Quebec's private sector privacy legislation, including an overview chart of the anonymization regulation, is available to AccessPrivacy subscribers on the Law 25 Resource Page.