The privacy impact assessment, demystified: how to assess an AI project before you deploy it

Planning to deploy an AI assistant that will read your emails, your quotes or your employee files? Law 25 asks you to do your homework before, not after. Since September 22, 2023, section 3.3 of the Act respecting the protection of personal information in the private sector (CQLR c. P-39.1) has required a privacy impact assessment from every business launching a project to acquire, develop or redesign an information system that processes personal information.

The obligation applies to every business, with no size or revenue threshold. The 12-person SME is caught just as much as the multinational. And the risk is no longer theoretical: the Commission d’accès à l’information (CAI) can impose administrative monetary penalties directly, up to $10M or 2% of worldwide revenue, and its first penalties were made public in 2026.

The good news: an assessment is not a 200-page study. The Act says it must be proportionate to the sensitivity of the information, the purpose of its use, its volume, its distribution and its medium. For a well-scoped AI project, this is a structured exercise of a few days, not a few months.

Section 3.3 sets out three triggers: the acquisition, the development and the redesign of an information system or an electronic service delivery system involving personal information. In practice an AI project almost always ticks at least one box.

Take a manufacturer in Granby that wants a quoting assistant: past projects contain client names, email addresses, signatures, sometimes employee data. As soon as a system touches information that makes it possible to identify a person, directly or indirectly, the assessment is required before deployment. And your employees’ data counts every bit as much as your clients’.

The Act names a conductor: the privacy officer, who has to be consulted at the very start of the project. By default that role falls to the person with the highest authority in the business, often without their knowing it. If you have never formally delegated the function, your president is carrying it today.

Around that person, a small team is enough: the project owner on the business side (the one who knows what data actually moves), an IT representative and, if an external supplier is involved, someone tasked with collecting their written answers on hosting, subcontracting and data use. It remains prudent to get legal advice on the complex cases, transfers outside Quebec in particular. But most assessments for internal projects are run in-house, with a rigorous grid and a bit of method.

Stage one: map the flows. What personal information enters the system, where does it come from, where is it stored, who has access, which third parties does it move to, and how long is it kept? If you already maintain the personal information register Law 25 requires, you have a head start: the assessment is its natural extension, project by project.

Stage two: assess the risks. For each flow, estimate the likelihood and the seriousness of a privacy breach. The typical risks in an AI project: information leaking through the queries sent to a supplier, re-identification of people from poorly de-identified data, an assistant revealing HR information to an employee who should not see it, or your data being reused to train a third party’s model. That last point deserves particular attention: reusing personal information to train a model amounts to a new purpose, which needs its own legal basis.

Stage three: choose the mitigation measures. Minimizing collection, redacting personal information before processing, role-based access control, encryption at rest and in transit, query logging, human sign-off before any action that affects a person. Every risk identified at the previous stage has to find its answer, or be explicitly accepted by management.

Stage four: document. A dated report recording the scope, the flows, the risks, the measures chosen, the residual risks and the final decision. That document is revised whenever the system changes significantly: new supplier, new data source, new feature. It is the one you will produce if the CAI examines your practices.

Here is the starting grid we use to frame a first conversation. It does not replace a full assessment, but it has one virtue: if you cannot answer one of these eight questions, you are not ready to deploy.

Section 17 adds a separate requirement: before disclosing personal information outside Quebec, a business must carry out an assessment that considers, among other things, the sensitivity of the information, the purpose of its use, the protective measures and the legal regime applicable in the destination state. The disclosure can only take place if the assessment demonstrates adequate protection, and it must be the subject of a written agreement.

This is where many AI projects stumble. Sending extracts of client files to an AI API hosted in the United States is a disclosure outside Quebec. Using an American SaaS with no prior assessment is among the most common non-compliances found in Quebec businesses. And physical location does not settle it: under the CLOUD Act, a 2018 American statute, an American-owned provider can be compelled to hand over data even when it is stored in Canada. What counts is the owner’s jurisdiction, not the data centre’s address.

Every flow that leaves your perimeter adds a layer to the assessment: a processor to govern by contract (s. 18.3), a foreign legal regime to analyze, a written agreement to negotiate. Conversely, when the AI model runs on a server on your premises or with a Quebec host under your control, whole sections of the assessment fall away on their own: no transfer outside Quebec, so no analysis under section 17; no model provider receiving your data; and a verifiable guarantee that your information is never used to train a third party’s model.

To be clear: the assessment stays mandatory, and hosting on your own premises exempts you from nothing. But the nature of the exercise changes. You document measures you control (redacting personal information before processing, role-based access, an audit log of queries) rather than weighing the contractual promises of a supplier you cannot verify. For an SME with no in-house lawyer, that is often the difference between a few days of structured work and weeks of contractual back-and-forth.

Three concrete moves to get going. First, confirm who your privacy officer is and publish their title and contact details on your site: that obligation has been in force since September 2022, and this is the person who will carry the assessment. Next, inventory the AI projects underway, including the tools your employees use without approval: each one is a potential section 3.3 trigger. Finally, take the most advanced project and run it through the eight-question grid above; the holes you find are your work plan.

To place the assessment within the wider effort, see our complete guide to Law 25 compliance and our 12-step checklist. And if you would rather have support, our approach always starts with an audit that includes mapping personal information flows: exactly the first stage of an assessment.