Quebec's Law 25 and French-language rules for Montreal collaboration tools

What to take away

Law 25 consent duties for Montreal collaboration tools

Quebec Law 25 sets the rules for how a Montreal employer collects, uses and discloses personal information. Consent has to be clear, specific and given for each purpose. A single click buried in a main services agreement is not enough. That matters when a tool collects names, email addresses, meeting recordings, chat logs or device identifiers.

The law also expects you to ask for consent separately from other information you present to a person. Section 8 of the private-sector Act, the statute Law 25 amended, requires consent that is manifest, free and enlightened.

If you roll consent into an employment contract or a software terms page, you weaken your position. The Commission d'accès à l'information can act on complaints from employees and customers.

For legal context on privacy provisions, the province's justice and civil status pages explain how Quebec law is organized.

Montreal's AI and video-game cluster makes this practical, not theoretical. Studios record playtests, standups and design reviews. Agencies run client calls with recording on by default. Each of those creates personal information. Consent for the recording is separate from consent for the tool storing it.

Consent also has a shelf life. If you switch from one meeting tool to another, or turn on a new transcription feature, the old consent may not cover the new purpose. Re-paper it. Use team agreements to record which tools are approved, who can record, and how long recordings live.

Employees are not the only data subjects. Contractors, job applicants and client contacts all have rights. A Montreal IT manager should be able to name the lawful basis for each tool that touches those groups.

Privacy impact assessments before a tool goes live

A privacy impact assessment is a structured review of how a project affects personal information. Under Law 25, certain projects require one before they start, and the assessment must be proportionate to the sensitivity of the data, the purpose and the number of people affected. A new collaboration platform usually triggers one.

The duty sits in section 3.3 of the private-sector Act. There is no headcount or revenue threshold. A ten-person studio that adds a recording tool and a large enterprise that adds a chat tool both fall inside it. What changes is the depth of the assessment.

Many collaboration vendors process data in the United States or the European Union. That is allowed, but you must assess the legal environment and the safeguards.

Do the assessment before the pilot, not after. A pilot that quietly collects real employee data is already a live processing activity. If the assessment later says no, you have a problem.

Use the information and services hub to locate the current guidance rather than relying on a summary from a vendor's marketing page. For bilingual teams, the federal privacy commissioner's French-language privacy topics are useful when a tool also falls under PIPEDA.

Document the outcome. A short assessment that names the risks and the mitigations is better than a long one nobody can find. Keep it with the contract and the security review.

Charter of the French Language interface requirements

The Charter of the French Language requires that software used by employees in Quebec be available in French. That includes the interface, menus, help screens and error messages. A tool that only speaks English creates a compliance risk and a practical one: staff work slower and make more mistakes.

The software duty comes from section 27 of the Charter. Bill 96 amended that section, and the obligation applies from 1 June 2025. The Office québécois de la langue française supervises the Charter.

French must be the default for Quebec users. English can be available, but it should not be the only option. The rules also touch on commercial publications and documents, so check how your email signatures, templates and internal announcements are handled.

This is not only about translation. A poor French interface is still a French interface in name only. Test the menus and the mobile app. Check the language of automated emails the system sends to employees, such as password resets and meeting invites.

For hiring and staff management context, the province's hiring and managing staff guidance is a sensible starting point. It covers workplace communications and the language duties that come with managing a Quebec team.

If a vendor cannot show you a French interface, treat that as a procurement finding, not a training problem. Your staff should not be expected to translate software in their heads.

Configuring French defaults in business email and productivity software

Configuration is where the law meets the daily workflow. Set French as the default language for the tenant, then let individual users choose English if they prefer it. That order matters: default French, optional English.

Two suites most Montreal employers already run show what to expect. Microsoft 365 ships French Canadian interfaces for Outlook, Teams, Word and Excel, but the display language is set per user rather than by one tenant-wide switch, so admins deploy it by script or policy.

Google Workspace offers French Canadian across Gmail, Docs and Meet. Its Admin console has a default language setting for the organization, so new accounts start in French. Check that the setting covers mobile apps as well as the web.

Start with these steps:

A checklist for the first month:

Be careful with team collaboration pricing tiers. Some vendors charge more for language packs or for the admin controls that let you enforce a default. Ask before you sign.

AI features need their own check. If AI meeting notes generate summaries in English only, that is a French-language gap and a privacy question at the same time.

Employee data in Montreal collaboration tools

Employee data includes more than payroll. It includes chat messages, calendar entries, file metadata, badge logs and performance notes. If it sits in a collaboration tool, it is personal information under Law 25.

Retention is the common failure. Teams keep everything by default because storage is cheap. Set retention schedules by category: meeting recordings, chat, files, and HR records. Delete on schedule and record that you did.

Typical settings are 30 to 90 days for meeting recordings, 12 to 24 months for chat, and six years for payroll records, which matches Revenu Québec's record-keeping rule.

Those are starting points, not standards. The sensitivity of the data and any legal hold decide the final number. Write the number into the retention schedule and into the tool's own settings.

Access should be role-based. A manager does not need every channel. A vendor support engineer does not need production data. Review access when someone changes roles or leaves. Run a full review each quarter and keep the output. Offboarding should close the account the same day.

Training is part of the control. Staff who know what counts as personal information make fewer mistakes. Keep a short record of who attended.

The three jobs that collaboration tools do, messaging, meetings and files, each carry different data risks. Treat them separately in your rules.

Documenting compliance for the Commission d'accès à l'information

The Commission d'accès à l'information is Quebec's privacy regulator. It handles complaints, conducts investigations and can issue orders. If a complaint arrives, you will need records, not recollections.

Keep a compliance file with these items:

Filing is straightforward. The Commission takes complaints in writing, and the form and contact details sit on cai.gouv.qc.ca. You can complain directly without going to court first.

On timing, the private-sector Act generally gives 30 days to answer a request for access or rectification. A confidentiality incident that presents a risk of serious injury must be reported to the Commission and to the people affected, and it goes in promptly.

How long the Commission takes to work a complaint depends on the issue and its caseload. It can also dismiss a complaint it finds unfounded.

Penalties scale with the offence. Administrative monetary penalties can reach $10 million or 2 percent of worldwide turnover, whichever is greater. Penal fines can reach $25 million or 4 percent of worldwide turnover. Charter fines rise for repeat offences.

The test is simple. When a complaint arrives, the file should already hold the assessment, the consent record, the retention schedule and the French screenshots.

Use an internal wiki software page as the register of tools, owners and review dates. It should be easy to update and easy to find. A register that lives in one person's inbox is not a register.

For general business context on Quebec rules, the businesses portal, the Entreprises et travailleurs autonomes section of quebec.ca, is a useful reference point. Review the file once a year, or after any tool change. Compliance is a maintenance task, not a one-time project.

Common questions