List the companies that can see personal information about your clients or your employees. The payroll service. The CRM. The accounting software. The newsletter platform. The agency that hosts your website and receives your contact forms. A small business easily reaches a dozen, and most of them were picked on some afternoon with a credit card in hand.
In a website security and compliance engagement, this is one of the first questions we ask, and it often goes unanswered: which of those vendors do you have a contract with that mentions personal information? Quebec's Law 25 does not stop you from handing them that information. It asks you to do it in writing, and it says what the writing must contain.
The short answer, for the busy
Section 18.3 of Quebec's Act respecting the protection of personal information in the private sector lets a business pass personal information to a vendor without asking the consent of the people concerned, when that is necessary to carry out a mandate or a contract for services. In return, the mandate or contract must be in writing and must specify the measures the vendor takes to protect the confidentiality of the information, to use it only for the mandate and to not keep it after the contract expires. The vendor must notify your person in charge of the protection of personal information without delay of any violation or attempted violation, and must allow that person to verify. Members of a professional order, such as your CPA, are exempt from part of these requirements, but not from the written mandate. If the vendor is outside Quebec, section 17 adds a privacy impact assessment and a written agreement.
What section 18.3 says, piece by piece
The first paragraph opens the door: a business may communicate personal information without consent to any person or body "if the information is necessary for carrying out a mandate or performing a contract of enterprise or for services" it entrusts to them. The word doing the work is "necessary", and Quebec's privacy regulator, the Commission d'accès à l'information, reminds businesses on its site that exceptions to consent must be interpreted restrictively. The agency sending your newsletter needs email addresses, not birth dates or full purchase histories.
The second paragraph sets the price of that open door. The mandate or contract must be entrusted in writing. It must specify the measures the vendor takes on three points: protecting the confidentiality of the information, using it only for the mandate, and ensuring it "does not keep the information after the expiry of the mandate or contract". Finally, the vendor must notify your person in charge of the protection of personal information "without delay" of any violation or attempted violation of the confidentiality obligations, and allow that person "to conduct any verification relating to confidentiality requirements".
An incident at your vendor is still an incident involving information you hold: you are the one who records it in your incident register and, if there is a risk of serious injury, notifies the Commission and the people affected (section 3.5). Section 3.1 makes the business responsible for the personal information it holds, and the Commission adds, in French, that a business always remains responsible for the information entrusted to it. The contract's first job is making sure you hear about an incident in time to follow your response plan.
Your accountant is not your CRM
The third paragraph of section 18.3 draws a line few Law 25 summaries mention. Subparagraph 2, the one listing what the contract must specify and setting the incident notice, does not apply when the vendor is a public body or "a member of a professional order".
The reason is easy to guess from the Professional Code. Its section 60.4 already requires every professional to "preserve the secrecy of all confidential information that becomes known to him in the practice of his profession."
Two clarifications, in our reading. First, the exemption covers subparagraph 2, not the written mandate of subparagraph 1: your CPA still needs a written mandate, and an engagement letter normally plays that role. Nothing stops you from naming in it who to notify about an incident. Second, the exemption follows the professional, not the service. A bookkeeping service whose staff belong to no professional order is a vendor like any other. As for your lawyer, section 18 separately allows a business to communicate personal information to its attorney without consent.
The cloud accounting software you subscribe to belongs to no order. Neither does the CRM, the payroll service or the web agency: those are the vendors section 18.3's requirements are written for.
The inventory nobody has
Step one is a list: every vendor that receives, stores or can view information about your clients or employees. Four columns per vendor are enough: which information, for which service, where it is hosted, and where the contract document is.
The ones people forget most easily: the booking tool, the free online form builder, the e-signature platform, the chat widget on the website, the AI note taker an employee connected to their calendar, and the IT contractor with remote access to the server who never signed anything.
Section 3.2 requires governance policies that set out roles and responsibilities across the whole life cycle of the information, and the vendor inventory is their backbone (see our article on the governance policy). And the law has vendors report incidents to your person in charge of the protection of personal information. They need to know who that is.
The terms you never negotiated
Nobody negotiates a contract with their CRM. You click "I agree". The section 18.3 requirements often sit in a document accepted without reading: the data processing agreement, or DPA. Look for that title on the vendor's legal page.
Take HubSpot's, a widely used CRM, in the version last modified on September 16, 2026. Its definition of applicable data protection laws names Canada's. Set it against section 18.3. Use limited to the mandate: HubSpot commits to processing customer personal data only for the purposes described in the DPA or within the customer's instructions. Confidentiality: authorized personnel are subject to confidentiality obligations. Retention: data is deleted or returned when the subscription ends, except where the law requires retention and except backups, which are isolated and later deleted under its own practices. Breaches: notice "without undue delay, but no later than seventy-two (72) hours" after HubSpot becomes aware. Verification: its SOC 2 report on request, and written answers to reasonable questions, no more than once per calendar year unless there are reasonable grounds to suspect non-compliance.
Every requirement has a counterpart. Three caveats, though. The breach notice goes to the customer, meaning the account's contact address: make sure it reaches your privacy officer, not an employee who left two years ago. Verification goes through reports rather than a site visit, which in our view is a reasonable way to allow verification for a vendor serving thousands of businesses. And the vendor reserves the right to amend the DPA: note the date of the version you read.
If your vendor publishes nothing of the kind, and its terms say nothing about use, retention or incidents, section 18.3 is not satisfied. Ask for an addendum. A refusal tells you something useful about the vendor.
When the vendor is outside Quebec
Section 18.3 is not the only rule in play. If the information leaves Quebec, section 17 first requires a privacy impact assessment. It weighs the sensitivity of the information, the purposes it will be used for, the protection measures "including those that are contractual", and the legal framework of the State where it would be communicated. If the assessment shows adequate protection, the communication may go ahead, and it must be the subject of a written agreement. Entrusting a person or body outside Quebec with simply keeping the information triggers the same obligations, which describes nearly every cloud application hosted in the United States.
The Commission specifies that the rule covers an entity outside Quebec, whether in another province or another country: a payroll service hosted in Calgary counts. And section 3.3 already requires an assessment before acquiring an information system involving personal information; in our view, subscribing to new software is acquiring one.
The vendor's DPA feeds that assessment; it does not replace it. The full method is in our privacy impact assessment guide and our article on data hosted outside Quebec. Our assessment generator produces the document from your answers.
Your web agency is a vendor too, ours included
An agency that hosts your website, receives contact forms, manages newsletter sign-ups or has access to your online store is performing a contract for services that involves your personal information. It is a vendor under section 18.3, exactly like the CRM. So is Peich.
Ask your agency what you would ask the others: where the forms and backups are hosted, who can access them, which parts of the work it passes on to someone else, what happens to the data when the contract ends, and who it notifies about an incident. The same questions apply to an AI agent vendor: see our article on choosing one.
The day you switch vendors
Section 18.3 requires the contract to stop the vendor from keeping the information after it expires. Section 23 requires you to destroy or anonymize information once the purposes it was collected or used for are achieved, unless a law sets a preservation period. The two meet when you leave a vendor.
At that point, first get your data back in a usable format, before the account closes. Then get it deleted, or at least find out what the vendor keeps and for how long. The retention periods for your own records are in our article on data retention.
Where to start
This week: list your vendors, find each one's DPA or contract and note its date, check that the address that will receive an incident notice is the right one, and flag the vendors that host your data outside Quebec. The gaps show up fast. If you would like us to go through the list with you, we can start with the vendors behind your website.
→ Let's talk about your vendors
This article explains legal obligations to help a small business ask the right questions; it is not legal advice. The text of Quebec's Act respecting the protection of personal information in the private sector, the Professional Code and your vendors' contracts as of the date you read them prevail: for a specific situation, consult a lawyer.
Written byXavier Peich