Bill 25 and Landlords in Quebec: Legal Obligations and Compliance Risks

Does Bill 25 Apply to Me as a Landlord?

Yes, it does. The moment you rent out even a single residential property in Quebec, you are considered to be operating a business under the law. Bill 25 on the Protection of Personal Information in the Private Sector applies to you entirely, even if you manage just one property. There is no exemption for small landlords.

This law modernizes Quebec's personal data protection framework. It came into force in phases starting in September 2022 and imposes increasing obligations through 2024. If you had any doubt, this is your confirmation: ignoring Bill 25 is not an option.

Three Key Dates You Need to Know

Bill 25 has a staggered implementation timeline. Here's what matters for you:

September 2022 : General provisions and citizen rights came into force. This is when most basic obligations already apply.

September 2023 : New rights for tenants, including data portability (they can request a copy in a structured format).

September 2024 : The right to be forgotten and de-indexing became operational. Tenants can force deletion or anonymization of certain data.

If you've done nothing so far, you're already behind on several fronts. The urgent priority now is to catch up on lost ground.

What Tenant Data Can You Actually Collect?

Bill 25 is built on one principle: minimize collection. You can only request data that is strictly necessary to make a rental decision.

Justified information includes:

• Name, address, phone number, email address
• Income or proof of employment (to assess payment capacity)
• Rental history (past tenant references)
• Personal or professional references

Problematic or prohibited:

• Social Insurance Number (SIN) during the initial application. You can request it later, after the lease is signed, if necessary for administration.
• Full detailed credit report obtained without explicit consent
• Complete criminal history or police record
• Biometric data, health data, sexual orientation, or ethnic origin

A candidate refuses to provide certain information? You cannot penalize them for it, but you can reject their application based on other objective criteria. The line is fine. Consult a lawyer or property manager if you have doubt about a specific refusal.

The Privacy Officer Requirement: Don't Overlook It

If you operate a business (which you do as a landlord), you must designate a privacy officer.

This person can be:

• Yourself (if you have the time and skill)
• A member of your team (if you have a property manager or assistant)
• An external specialized company (increasingly common for small landlords)

The privacy officer's responsibilities include:

• Implement a privacy policy
• Document where and how data is stored
• Handle tenant access requests
• Manage security incidents (e.g., email sent to the wrong person)
• Cooperate with the Commission d'accès à l'information (CAI) if a complaint arises

If you don't officially designate someone, you are not in compliance. This failure will be noted during an inspection or if a complaint is filed.

How Long Must You Keep Tenant Files?

A legitimate question: "When can I throw away my tenant's documents?"

There is no single retention period. The rule is: keep data as long as it is necessary. After a tenant moves out:

• Application file and references: generally 12 months is sufficient (beyond that, there is no legitimate interest)
• Active tenant file: during the lease term plus documents after departure
• Rental payment data: keep for your taxes and as proof (7 years for Canada Revenue Agency, 6 years for Quebec law)
• Security deposits and receipts: at least until any potential disputes are resolved

Once the retention period expires, you must destroy or anonymize the data. Failing to do so can result in a fine. Yes, it is an active obligation.

Data Incidents and Breaches: Your Process

A privacy incident occurs when data escapes your control. Example: you email a credit report to the wrong candidate, or a former tenant discovers their file is accidentally accessible on your server.

Your process:

1. Detect the incident and document it (date, time, data involved, number of people affected).
2. Assess the risk: does the breach present a real risk of serious harm to rights and freedoms? (discrimination, identity theft, etc.)
3. If serious risk: you have 30 days to report the incident to the CAI and notify affected individuals.
4. If low risk: you document but are not obligated to report (example: lost envelope containing a candidate's name and phone number, but no sensitive information).

The CAI can investigate. If it finds a serious violation, fines will follow.

Financial Risks: Fines and Penalties

Bill 25 gives the CAI significant enforcement powers.

For a business (even a small rental property is considered a "business"):

• Fine up to 25 million dollars or 4% of gross annual revenue, whichever is higher
• For serious violations (e.g., mass collection without consent)

For an individual (if you are personally in breach):

• Fine between 5,000 and 100,000 dollars
• Possible civil action by an affected tenant

These amounts are not theoretical. The CAI is strengthening enforcement. Even a small property with 3 units can attract attention if a tenant files a complaint.

How to Get Compliant Quickly

Step 1: Internal audit (1 to 2 weeks)

• List all files you have (applications, leases, payments, incidents)
• Identify where they are stored (paper, hard drive, cloud, email)
• Flag unnecessary sensitive data to discard

Step 2: Privacy policy (1 week)

• Write a simple policy explaining why you collect data, how you store it, and what rights tenants have
• Include it in your rental application form and lease
• Keep a digital and paper copy

Step 3: Designate a privacy officer (1 day)

• Decide who will be responsible: you, a team member, or a third party
• Document this appointment (a simple written decision is enough)

Step 4: Access request process (1 week)

• A tenant can request a copy of their data. Prepare a response template.
• Legal deadline: 30 days to provide the information
• You can charge reproduction fees (paper, digital), but no more than actual cost

Step 5: Secure storage (2 to 4 weeks)

• Paper files must be locked (filing cabinet or locked drawer)
• Digital files: password protected, encrypted if possible
• If using cloud storage (Google Drive, OneDrive), ensure the provider offers minimum security standards
• No sharing of data with third parties without written consent

Step 6: Scheduled destruction (ongoing)

• Establish a calendar: each year, identify and destroy old data no longer necessary
• Keep a written record that destruction took place

If you manage multiple properties, delegate this task to a professional manager. It's an investment, but cheaper than a fine.

How This Fits With Your Current Management Practices

Bill 25 does not prohibit you from checking tenant backgrounds. It simply requires you to do so transparently and within limits.

If you use a credit verification agency, they too must be compliant with Bill 25. Ask them to certify their compliance. If you use a professional property manager, they assume some privacy officer responsibilities, but you remain ultimately accountable.

The classic tension: you want detailed information to assess risk properly; the law limits you to what's necessary. Solution: prioritize verification of current employment and past rental payments rather than exhaustive credit reports.

Critical Points Summary

• You are subject to Bill 25, even with a single property
• Three implementation phases: you are already behind on some points
• Collect only the minimum: name, contact details, income, references
• Designate a privacy officer: you or a qualified third party
• Keep data as long as necessary, then destroy
• Manage incidents based on risk level
• Substantial fines if you ignore the law

The good news: compliance is not rocket science. It's a matter of organization and discipline. Start with an internal audit, then establish a clear process. You will protect your tenants, protect yourself, and sleep better at night.

If you have a complex file or an incident, consult a lawyer or firm specialized in Quebec real estate law. It's a small investment that can save you a large fine.