The pages that rank for this question quote the definition, then give a list: name, address, social insurance number. Nobody hesitates over a social insurance number. When we take on a client's website security and compliance, the hesitation comes from what the site collects without anyone having decided to: the IP address in the server logs, the work email on a quote request form, the team photo, the label an AI tool sticks on a prospect.
This article works through those cases one at a time, with the text of the law and the positions of the authorities. Before you ask what to do with a piece of information, you have to know whether it is personal information at all.
The short answer, for the busy
In Quebec, personal information is any information which relates to a natural person and directly or indirectly allows that person to be identified (section 2 of the Act respecting the protection of personal information in the private sector). The word "indirectly", in force since September 22, 2023, covers what identifies someone by cross-referencing: in our view, an IP address or a cookie identifier that can be linked to a person. Business contact information (name, title, work address, email and phone) is still personal information, but the rules on collection, use and communication do not apply while it concerns the person's duties. So is a photo in which someone can be recognized, and what an AI system infers about a person, according to the Commission d'accès à l'information. De-identified data stays personal information; only data anonymized under the regulation falls outside the Act. Information is sensitive because of its nature (medical, biometric, intimate) or its context, and using it for another purpose then requires express consent.
One test, and the word added in 2023
The historical versions of the Act published on LégisQuébec show that the words "directly or indirectly" were not in section 2 before September 22, 2023.
That addition moves the question: a field that names no one can still identify someone once combined with what you already hold or can easily find.
Two clarifications settle a lot of arguments. The test is about a natural person: the revenue of a corporation is not personal information, while a self-employed person's revenue is their income. And section 1 covers information in any form, "whether written, graphic, taped, filmed, computerized, or other": a recorded phone call counts as much as a form field.
Work emails: a narrower exception than people think
Yes, an email address that identifies a person is personal information, including at work. Section 1 adds a nuance. Divisions II and III of the Act do not apply "to personal information concerning the performance of duties within an enterprise by the person concerned, such as the person's name, title and duties, as well as the address, email address and telephone number of the person's place of work."
We read three things in that sentence. Business contact information is still personal information: the Act exempts it from two divisions, not from the definition. Those divisions cover collection, use, communication, security and destruction, but not the right of access in Division IV. And the exception depends on what the information is about. The domain name of the address changes nothing.
In practice, on that reading, the purchasing manager who fills in your quote form with their name, title and office email is covered by the exception. If they use that same email to book a personal appointment at a clinic, they are not: the information now concerns their health, not their duties. A freelancer's Gmail address used for their business is a case the text does not clearly settle, so ask a lawyer rather than guess.
In our view, a generic address like info@ does not designate anyone, until a single employee signs everything sent from it.
Newsletters also fall under Canada's Anti-Spam Legislation, whose paragraph 10(9)(b) follows the same logic: implied consent for an address that was conspicuously published, with no statement refusing messages, when the message relates to the person's duties.
IP addresses and cookie identifiers
We found no page from the Commission d'accès à l'information (CAI) that rules on IP addresses by name. The federal Office of the Privacy Commissioner writes on its own website that an IP address could identify someone in certain circumstances, and that it considers the IP address to be personal information, "particularly when combined with other data automatically collected" such as the page visited and the time of the visit. In 2024, in R. v. Bykovets (2024 SCC 6), the Supreme Court held that an IP address attracts a reasonable expectation of privacy, describing it as the first digital trace that can lead to a person's online activity. That case was about the Charter, not Law 25.
Our cautious reading: treat an IP address as personal information as soon as you can link it to anything else. A form that stores the IP alongside a name and email ties it to a named person. Your host's logs keep it next to every page requested.
An advertising or analytics cookie identifier goes further, because it is built to recognize the same browser from one visit to the next. That is the territory of section 8.1, which requires informing the person beforehand of the use of technology that allows them to be identified, located or profiled, and the CAI concludes that such technologies cannot be switched on by default. See our guides on cookies and forms and on cookieless analytics, the option that sidesteps the question.
Statistics, pseudonymized data, anonymized data
A table that says "142 quote requests in September, 38% from Laval" describes no one. In our view, that is not personal information, as long as no cell corresponds to a single individual. A row reading "1 request, Gaspé, funeral services" can be enough to recognize someone.
In between, the Act creates de-identified information (section 12): information that no longer allows the person to be directly identified. In our view, a session recording with the form fields masked is one, and it is still personal information. Only information anonymized under section 23 and its regulation leaves the Act. The process is laid out in our article on anonymization.
Photos: personal first, biometric second
A photo in which an employee or customer can be recognized is personal information, and the right to one's image under the Civil Code applies on top: see our article on photo consent.
The edge case comes when the same photo goes through a facial recognition tool. It then becomes the source of biometric information, which the CAI describes as sensitive and intimate, with its own obligations, including, in some cases, a declaration to the Commission. See our article on workplace biometrics and employee monitoring.
What an AI infers is personal information too
The CAI states that information generated by artificial intelligence systems, or inferred from other information, is personal information subject to the applicable laws. Section 27 points the same way when it excludes from portability personal information "created or inferred" using other personal information.
On a website, that covers the chatbot that tags a visitor as a "hot lead", or the tool that summarizes a conversation and notes that the customer "seems to be in financial difficulty". That inference concerns financial status, one of the CAI's examples of sensitive information, even though nobody typed it in. On our reading, section 8.1 names the activity: profiling, defined as collecting and using personal information to assess certain characteristics of a person, such as their economic situation, personal preferences, interests or behaviour.
The "sensitive" test: nature, or context
Section 12 defines personal information as sensitive "if, due to its nature, in particular its medical, biometric or otherwise intimate nature, or the context of its use or communication, it entails a high level of reasonable expectation of privacy." The CAI's examples include health, sexual orientation, biometrics, ethnic origin, beliefs and financial status.
The second criterion is the one that surprises people. A name and an email are mundane on a hardware store's newsletter. The same two fields on a fertility clinic's appointment form reveal something intimate simply by being there.
The consequences are specific: express consent to use the information for another purpose (section 12) or to communicate it (section 13), security measures that account for sensitivity (section 10), and a privacy impact assessment (PIA) proportionate to it (section 3.3).
What on your website triggers obligations
Walk through every entry point. Contact, quote and booking forms, like a newsletter sign-up, require you to set the purposes before collecting, to collect only what is necessary and to inform the person (sections 4, 5 and 8). Cookies, pixels and analytics tools that recognize a browser fall under section 8.1. A chat widget, booking tool or form hosted outside Quebec sends the information out of the province, which requires a PIA beforehand (section 17). All of it belongs in a privacy policy written in clear and simple language (section 8.2). The overall picture is in our summary of Law 25 obligations; for whether it or the federal law applies to your business, see PIPEDA or Law 25.
A new collection calls for a PIA when it comes with a project to acquire, develop or overhaul an information system (section 3.3), or when the information leaves Quebec (section 17). A new form wired to a CRM hosted outside Quebec checks, in our view, both boxes. Our PIA guide for private businesses explains the process, and our online PIA tool drafts the document from your answers.
Where to start
Go through your site as a visitor would and note every place they leave something behind: a field, a cookie, a photo, a conversation. For each one, ask three questions. Does it tell you who this is, alone or combined with something else? Does it concern their job or their private life? Does the context make it sensitive? The answers give you the list your privacy policy needs to name.
That inventory, and the fixes that follow, are part of our website security and compliance work.
→ Let's talk about your website
This article explains legal obligations to help a small business ask the right questions; it is not legal advice. The text of the Act respecting the protection of personal information in the private sector and the positions of the Commission d'accès à l'information govern: for a specific situation, consult a lawyer.
Written byXavier Peich