Quebec's Law 25 and client data: what a mortgage broker actually needs to do

Every week you receive bank statements, pay stubs, notices of assessment, and sometimes a social insurance number over unencrypted email. If a client asked you today what happens to those documents once the file is closed, would you have a clear answer? Quebec's Law 25 requires that you have one — and that you can prove it.

What Law 25 actually changes for a broker

Law 25 applies to any business that collects, uses, or retains personal information as part of its activities in Quebec — which obviously includes a mortgage brokerage. Among other things, it requires: clear, specific consent for each use of the data, the appointment of a person responsible for the protection of personal information, a log of privacy incidents, and the ability for a client to request access to or deletion of their information.

In practice, a mortgage file contains some of the most sensitive information there is: income, debts, social insurance number, banking history. That's not peripheral data — it's the core of your work. The law therefore demands a level of rigour that goes beyond ordinary professional common sense.

Consent: more than a checkbox

Consent must be obtained for a specific purpose, at the time of collection, and it must be understandable without needing a lawyer to decode it. A generic form signed once isn't enough if you later share the data with a lender, an insurer, or an external analysis tool: every transfer to a third party must be covered by consent that specifies its purpose.

• Clearly state what each type of document requested from the client will be used for
• Name the third parties (lenders, insurers) who will receive all or part of the file
• Keep a timestamped record of consent for every file
• Provide a simple way for a client to withdraw consent or request deletion of their data

What should you do in the event of a privacy incident?

A privacy incident is unauthorized access, use, or disclosure of personal information — an email sent to the wrong person, a lost USB key, a compromised login. As soon as an incident presents a risk of serious harm, the law requires notifying the Commission d'accès à l'information as well as the affected individuals, and keeping a log of every incident, even minor ones. That log must be available on request. Many brokers only discover this obligation the day an incident happens — too late to improvise a process.

Data residency: can a broker use just any software?

A common question: does Law 25 require hosting data in Canada? The law doesn't explicitly mandate Canadian hosting, but it requires a privacy-impact assessment before any transfer of data outside Quebec, and that assessment must demonstrate an equivalent level of protection. In practice, choosing a provider that hosts in Canada avoids that complex assessment and reduces legal risk — which is why most brokerages choose it out of caution rather than strict obligation.

What CourtierIQ does to help

CourtierIQ is not certified by, nor a partner of, any regulatory body — no software can claim that. What the platform does is follow the published rules of Law 25 in its design: data hosted in Canada, a timestamped access log for every file and structured consent management per client (communications, credit check). The goal isn't to replace legal advice, but to give you a documented trail of your compliance, file by file.

Want to see how it works in your practice? Try CourtierIQ free for 14 days.