In a small business, the first access request often comes through the contact form, between two quote requests. A few lines citing section 27 of Quebec's private-sector privacy Act and asking for a copy of every document that concerns the sender: that is how the model letter published by the Commission d'accès à l'information (CAI) opens. The form, on the websites we build as on any other, drops it into a shared inbox, and the clock starts.
This article follows the request from arrival to answer, in a ten- or twenty-person business that has never received one. The legal part fits in about ten sections of the Act. The hard part is finding where your personal information actually lives.
The short answer, for the busy
In Quebec, a business that receives a request for access to personal information must reply in writing, promptly and no later than 30 days after receiving it, under section 32 of the Act respecting the protection of personal information in the private sector. Failing to reply within that time is deemed a refusal. The request must be made in writing by a person who proves their identity, and it must be addressed to the person in charge of the protection of personal information. Access is free of charge, but a reasonable charge may be required for transcription, reproduction or transmission, as long as the approximate amount is disclosed in advance. Since September 22, 2024, the person can also obtain the computerized information collected from them in a structured, commonly used technological format. Any refusal must give reasons, cite the provision it relies on and state the remedy: an application to the CAI for the examination of a disagreement, within 30 days.
Recognizing the request, and starting the clock
Section 30 sets three conditions for a request for access or rectification to be considered: it is in writing, it comes from someone who proves they are the person concerned (or their representative, heir, or a person with parental authority), and it is addressed to the person in charge of the protection of personal information. Nothing in the text requires an official form or a signed letter.
The same section settles a question that worries people for no reason: it "does not limit the communication of personal information to the person concerned or the rectification of that information as a result of a service to be provided to the person." A customer asking for their invoice again does not trigger a procedure. A customer asking for everything you hold on them does.
The 30 days in section 32 run from receipt. The safest reading is to count from the day anyone in the business received the request, even if it landed in the info@ inbox on a Friday night. With no reply by the deadline, the business is deemed to have refused, and the requester's time to seek a remedy starts running.
To get more time, the Act offers one route: ask the CAI, within the same 30 days, to extend the deadline, limit the scope of the request or let you disregard requests that are obviously improper (section 46).
A vague request is not a ground for refusal: section 30 requires the person in charge to help the requester identify the information sought.
Verifying identity without opening a new file
The Act requires the requester to prove their identity without saying how. Asking for a copy of a driver's licence is the wrong reflex: section 5 limits collection to the information that is necessary, and you would end up keeping and protecting an ID document you never had before.
Check against what you already hold instead: does the request come from the email address on file? If not, write to that address to confirm, or ask for a detail only the customer knows, such as an invoice number. For a representative or an heir, the Act also requires proof of their capacity: that is where a document is justified.
The search: where the information actually lives
In its fact sheet on searching for personal information (March 2025), the CAI says the business must carry out a complete and serious search, that it should not rely solely on a data register, and that if the requester challenges the answer, the business will have to prove the search was done.
The fact sheet lists the places to look: paper files, IT systems, email inboxes, instant messaging, archives, and information a third party, a subcontractor for example, holds on your behalf. In a small business, that starts with the inbox that receives website form submissions, and the site's database if submissions are stored there. Then come the CRM, or the spreadsheet standing in for one, the newsletter tool, which keeps a history of sends and opens, and the accounting and invoicing software. The email and messaging accounts of every employee who dealt with this customer belong on the list, and so do the AI tools someone may have pasted one of the customer's emails into, along with their conversation history. And finally, the backups.
They deserve a line in your search notes. The fact sheet says you don't have to provide information that has been destroyed, but information deleted from the CRM and still present in a backup has not been destroyed. Knowing how long your backups are kept is part of the answer (see our article on data retention).
The CAI also recommends keeping a written record of the search: who looked, where, with which keywords, for how long. Half a page will do. If the requester takes the matter to the CAI, that record is your evidence.
What answering means
Section 27 requires you to confirm the information exists, communicate it and allow the person to obtain a copy. At the applicant's request, computerized information must be provided as "a written and intelligible transcript": a CRM screenshot full of internal codes won't do.
The third paragraph adds portability, in force since September 22, 2024. Unless doing so raises serious practical difficulties, computerized information collected from the applicant, "and not created or inferred" from their information, must be communicated to them in a structured, commonly used technological format, or to a body authorized by law to collect it. The CAI explains that such a format is one that commonly used software can easily read, and that information obtained from third parties is excluded. A CSV export, which any spreadsheet opens, fits that description. When you choose your next CRM, check that it can produce that export per customer: section 3.3 requires any new system to allow it.
For a rectification request, section 35 requires you to issue, free of charge, a copy of the information modified or an attestation of its deletion.
As for fees, section 33 is plain: access is free. A reasonable charge may be required for transcription, reproduction or transmission, provided you tell the applicant the approximate amount before doing the work. For a PDF sent by email, charging costs more in goodwill than it brings in.
Refusing, and putting it in writing properly
The grounds for refusal are few and specific. A business may refuse where disclosure would likely hinder an investigation aimed at preventing or detecting offences, or affect judicial proceedings (section 39). It must refuse where disclosure would likely reveal information about a third party and seriously harm that person, unless the third party consents or there is an emergency (section 40). Sections 37 and 38 cover health information and minors under 14. A refusal can be partial: you communicate the file after removing what concerns other people.
Section 34 dictates what a refusal contains: the reasons, the provision of law it relies on, the remedies available and the time limit for using them, and help for a requester who wants to understand. A letter saying "we are unable to process your request" meets none of these.
Even when you find nothing, the wording matters. The CAI notes that a blanket statement that no information is held leaves the requester doubting how seriously the search was done, and recommends describing the steps you took.
Finally, section 36: if you refuse, you must keep the information concerned for as long as the requester needs to exhaust their remedies. Tidying up an unhappy customer's file is exactly what the Act forbids, and destroying personal information in contravention of the law is on the list of failures that can draw an administrative monetary penalty (section 90.1).
The recourse before the CAI
In the private sector, the recourse is an application for the examination of a disagreement; the "request for review" applies to public bodies. The requester files it in writing within 30 days of the refusal or of the expiry of the time to reply (section 43). The CAI, acting as an administrative tribunal, notifies the business and assigns a mediator to the file.
On the penalty side, a late reply is neither on the section 90.1 list nor among the section 91 offences, and the CAI states it cannot award damages. What you face instead is a file before a tribunal where you must show a complete and serious search that you never documented.
What your website should make easy
Three sections touch the website. Section 3.1 requires publishing the title and contact information of the person in charge, section 29 requires informing the public where and how information can be accessed, and section 8 requires telling people, when their information is collected, about their rights of access and rectification.
Your privacy policy should name the person in charge by title, give an email address that reaches them and explain in two sentences how to make a request. A dedicated address, read by the right person, keeps the request from sitting in the quotes inbox. The procedure itself (who receives, who searches, who signs the reply) belongs in your privacy governance policy, next to the complaint process.
Where to start
Before the first request arrives, three steps are enough: publish the contact information of the person in charge, list the places where your customers' information lives, and check that your CRM can export a customer record as CSV. When a request comes in, note the date, confirm the identity, search everywhere while keeping a record, and reply in writing before day 30.
The pages that make this path visible on your site, the policy, the contact information of the person in charge and a form that reaches the right inbox, are part of our web services.
→ Let's talk about your website
This article explains legal obligations to help a small business ask the right questions; it is not legal advice. The text of the Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information govern: for a specific situation, consult a lawyer.
Written byXavier Peich