Law 25 and your condo board: your obligations and the tools Kohabit gives you
Law 25 applies to every business and legal entity in Quebec, including your board. What it asks, what stays with the syndicate, and what Kohabit does on its side.
A practical guide, for information only. It does not replace legal advice.
Create my accountData hosted in Canada.
What is Law 25?
Law 25 (officially the Act to modernize legislative provisions as regards the protection of personal information) was adopted in 2021. It has applied in stages since September 2022, the last one landing in September 2024. It modernizes Quebec's privacy framework, which had been governed by a 1994 law.
Its goal is to give Quebec citizens real control over their personal information and to impose on organizations holding it obligations comparable to the European GDPR.
Law 25 applies to every business and legal entity operating in Quebec, regardless of size. This explicitly includes divided co-ownership condo boards, which are legal entities under the Quebec Civil Code.
Why your condo board is concerned
Many boards believe Law 25 only targets "large companies". This is wrong. A condo board handles personal information on a daily basis under the meaning of the law.
Identification data
Name, address, email, phone, date of birth of every co-owner and registered tenant.
Financial data
Share in voting shares, account balances, payment schedules, arrears, sometimes banking details.
Private-life data
Household composition, pets, vehicles, emergency contacts, maintenance requests revealing the unit's interior.
Written communications
Emails, complaints, nominative votes, noise reports. These exchanges often contain sensitive data.
The 6 key obligations for your board
1. Appoint the person in charge of the protection of personal information
By default, the highest authority on the board, usually the president. Their contact info must be published and accessible to co-owners.
2. Maintain a clear and accessible privacy policy
The board must be able to tell any co-owner what data is collected, why, who can access it, where it is stored and for how long. In plain language.
3. Keep a confidentiality incident register
Stolen binder, leaked email, unauthorized access to the co-owner list: each incident must be logged. If it presents a risk of serious harm, the CAI and affected persons must be notified without delay.
4. Conduct a privacy impact assessment before any new IT project
The law asks for one for any project to acquire, develop or overhaul an information system that involves personal information (s. 3.3). Adopting Kohabit triggers this obligation, and the assessment stays yours.
5. Frame any cross-border data transfer
If you use a tool hosted outside Quebec (USA, Europe), a comparative analysis of the foreign legal regime is required. A tool hosted in Canada avoids that analysis.
Note: Kohabit offers an optional Drive integration (Microsoft OneDrive / SharePoint). If the board enables it, this cross-border transfer applies again and the comparative analysis becomes necessary. Off by default. Details.
6. Honour the new co-owner rights
Right of access, rectification, portability, cessation of dissemination. The board must respond within 30 days.
Where your data sits, and what that changes
A tool hosted in the United States, even by a reputable vendor, exposes your data to the US CLOUD Act. This statute allows US authorities to compel access to your data even if it sits on Canadian servers, as long as the operator is an American company.
Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. One exception, which you turn on yourself: the OneDrive integration, which copies your documents to Microsoft. It is off by default. Details.
What that spares you: the comparative analysis of the foreign legal regime that section 17 requires as soon as personal information leaves Quebec.
What stays with the syndicate: its privacy policy, its incident register, and its answers to co-owners' requests.
The tools Kohabit gives you
Law 25 places the obligations on the board, not on its supplier. What Kohabit gives you, obligation by obligation.
Encrypted in transit and at rest
All data encrypted in transit (TLS 1.3) and at rest. Backups are also encrypted.
Hosted in Beauharnois, Québec
Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. One exception, which you turn on yourself: the OneDrive integration, which copies your documents to Microsoft. It is off by default.
Log of administration actions
Exports, closing the co-ownership, deletion requests and Drive connections are logged. Document views are not.
Granular permissions
Each user sees only what concerns them. A co-owner does not see others' financial data.
Built-in portability right
Each co-owner can download their personal data in one click, in an open exportable format.
Deletion on request
A co-owner deletes their account from their settings, and their personal data is anonymized right away.
Kohabit against an American tool, line by line and dated: the Buildium comparison.
The new co-owner rights
Law 25 grants co-owners (and registered tenants) new rights enforceable against the board, with a 30-day response deadline.
Right of access
Obtain a complete copy of their information held by the board, in an understandable format.
Right to rectification
Require correction of inaccurate, incomplete or outdated information.
Right to portability
Receive their data in a structured, reusable, exportable technological format.
Right to cessation of dissemination
Have information withdrawn when its diffusion causes harm (e.g. on an internal site).
Right to prior information
Know, at collection time, what the data will be used for and who will access it.
Sanctions for non-compliance
Law 25 sets out three kinds of sanction. Here are the ceilings the text fixes.
Administrative sanctions
Up to CA$10 million or 2% of worldwide turnover.
Criminal sanctions
Up to CA$25 million or 4% of worldwide turnover.
Civil remedies
Affected individuals may sue for damages, class actions are possible.
Frequently asked questions
Official sources
Read next
Your data in Beauharnois
A privacy policy you can quote, and a vendor you can reach. 60 days to try it.
Create my accountNo credit card required. Hosted in Canada. Cancel anytime.