What is Law 25?
Law 25 (officially the Act to modernize legislative provisions as regards the protection of personal information) was adopted in 2021. It has applied in stages since September 2022, the last one landing in September 2024. It modernizes Quebec's privacy framework, which had been governed by a 1994 law.
Its goal is to give Quebec citizens real control over their personal information and to impose on organizations holding it obligations comparable to the European GDPR.
Law 25 applies to every business and legal entity operating in Quebec, regardless of size. This explicitly includes divided co-ownership condo boards, which are legal entities under the Quebec Civil Code.
Why your condo board is concerned
Many boards believe Law 25 only targets large companies. It applies to every legal entity, and a syndicate is one. A condo board handles personal information on a daily basis under the meaning of the law.
Identification data
Name, address, email, phone, date of birth of every co-owner and registered tenant.
Financial data
Share in voting shares, account balances, payment schedules, arrears, sometimes banking details.
Private-life data
Household composition, pets, vehicles, emergency contacts, maintenance requests revealing the unit's interior.
Written communications
Emails, complaints, nominative votes, noise reports. These exchanges often contain sensitive data.
The 6 key obligations for your board
1. Appoint the person in charge of the protection of personal information
By default, the highest authority on the board, usually the president. Their contact info must be published and accessible to co-owners.
2. Maintain a clear and accessible privacy policy
The board must be able to tell any co-owner what data is collected, why, who can access it, where it is stored and for how long. In plain language.
3. Keep a confidentiality incident register
Stolen binder, leaked email, unauthorized access to the co-owner list: each incident must be logged. If it presents a risk of serious harm, the CAI and affected persons must be notified without delay.
4. Conduct a privacy impact assessment before any new IT project
The law asks for one for any project to acquire, develop or overhaul an information system that involves personal information (s. 3.3). Adopting Kohabit triggers this obligation, and the assessment stays yours.
5. Frame any cross-border data transfer
If you use a tool hosted outside Quebec (USA, Europe), a comparative analysis of the foreign legal regime is required. A tool hosted in Quebec spares you that for the data it keeps.
Note: Kohabit offers an optional Drive integration (Microsoft OneDrive / SharePoint). If the board enables it, this cross-border transfer applies again and the comparative analysis becomes necessary. Off by default. Details.
6. Honour the new co-owner rights
Right of access, rectification, portability, cessation of dissemination. The board must respond within 30 days.
Where your data sits, and what that changes
A tool hosted in the United States, even by a reputable vendor, exposes your data to the US CLOUD Act. This statute allows US authorities to compel access to your data even if it sits on Canadian servers, as long as the operator is an American company.
Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. One exception, which you turn on yourself: the OneDrive integration, which copies your documents to Microsoft. It is off by default. Details.
What that changes: the data Kohabit keeps stays in Quebec. A few services work elsewhere, such as sending notification emails; the Data in Canada page names them, so your analysis only has to cover those.
What stays with the syndicate: its privacy policy, its incident register, and its answers to co-owners' requests.
The tools Kohabit gives you
Law 25 places the obligations on the board, not on its supplier. What Kohabit gives you, obligation by obligation.
Encrypted in transit and at rest
Your data is encrypted in transit (TLS 1.3) and at rest, backups included.
Hosted in Beauharnois, Québec
Your data is stored in Beauharnois, Québec, with OVH Hosting Inc. One exception, which you turn on yourself: the OneDrive integration, which copies your documents to Microsoft. It is off by default.
Log of administration actions
You find exports, closing the co-ownership, deletion requests and Drive connections in a log. Document views are not in it.
Granular permissions
You give each person access to what concerns them: a co-owner does not see others' financial data.
Built-in portability right
Each co-owner downloads their personal data from their space, in an open format.
Deletion on request
A co-owner deletes their account from their settings, and their personal data is anonymized right away.
Kohabit against an American tool, line by line and dated: the Buildium comparison.
The new co-owner rights
Law 25 grants co-owners (and registered tenants) new rights enforceable against the board, with a 30-day response deadline.
Right of access
Obtain a complete copy of their information held by the board, in an understandable format.
Right to rectification
Require correction of inaccurate, incomplete or outdated information.
Right to portability
Receive their data in a structured, reusable, exportable technological format.
Right to cessation of dissemination
Have information withdrawn when its diffusion causes harm (e.g. on an internal site).
Right to prior information
Know, at collection time, what the data will be used for and who will access it.
Sanctions for non-compliance
Law 25 sets out three kinds of sanction. Here are the ceilings the text fixes.
Administrative sanctions
Up to CA$10 million or 2% of worldwide turnover.
Penal sanctions
Up to CA$25 million or 4% of worldwide turnover. These are penal offences, not criminal ones.
Civil remedies
Affected individuals may sue for damages, class actions are possible.
Frequently asked questions
Our board is small (6 units), does Law 25 really apply?
We use a shared Excel spreadsheet, are we compliant?
What if a co-owner asks for account deletion?
Do we need a PIA for just one tool?
Who signs the board's privacy policy?
If Kohabit has an incident, who is responsible?
How much does Law 25 compliance cost for a syndicate?
Official sources
Commission d'accès à l'information du Québec (CAI)
Law 25 supervisory authority, practical guides, policy templates, incident notifications.
Privacy Act (LégisQuébec, English version)
Full text of the law as modified by Law 25.