Bill 25 and Foreign Data Transfers in Co-ownership: Are They Permitted?

Bill 25 applies to divided co-ownership syndicates that hold, use and communicate personal information about their co-owners, tenants, employees and suppliers. The question often comes up before the board of directors: can we use software or a “cloud” service whose servers are located abroad? The short answer is yes, but under specific conditions, and they must be documented.

Content up to date as of 2026-07-29.

Quick reminder: what does Bill 25 cover in divided co-ownership?

Bill 25 modernizes the Act respecting the protection of personal information in the private sector. For a syndicate, this affects the management of co-owner files (contact information, account statements, assessments and condo fees), annual general meeting minutes, claims relating to losses, insurance claims, employees and suppliers. Among other things, it requires the appointment of a person in charge of the protection of personal information (PRP), the maintenance of a register of confidentiality incidents, oversight of service providers, and informing individuals about how their information is used.

In practice, several everyday tools are covered: email, office suites, backups, condominium management applications, connected cameras and even online payment modules for common expenses. The challenge for the board of directors is to align these uses with legal obligations without slowing down administrative efficiency.

Transfers outside Quebec: what does the law say?

The law allows personal information to be communicated outside Quebec if, before the transfer, the organization conducts a privacy impact assessment (PIA) and concludes that the information will receive adequate protection. Contractual and security measures must then be put in place (see the Act respecting the private sector, s. 17; LégisQuébec).

PIA: what must be assessed

• The sensitivity of the information (e.g., contact information, bank account numbers, information about a loss affecting private portions or common portions, access data for building facilities, etc.).
• The purposes of the transfer and its necessity (hosting, backup, technical support, analytics).
• The legal framework and practices in the receiving jurisdiction, including possible access by public authorities.
• The risks to individuals (confidentiality, integrity and availability) and their likelihood.
• Risk-mitigation measures: strong encryption, access controls, logging, data minimization, pseudonymization and service-provider management.

Document your PIA and keep it with your internal policies. The board of directors should approve it and record it in the minutes.

Consent, information and clauses

• Information: at the time of collection, you must inform the individual if their information could be communicated outside Quebec, the purposes involved and how to object when required (see the Act respecting the private sector, ss. 8 et seq.; LégisQuébec).
• Consent: explicit consent may be required for sensitive information or uses that are not necessary to carry out the syndicate’s mandate. In other cases, the law may authorize the communication if it is necessary for the purposes for which the information was collected and the safeguards are in place. If in doubt, opt for clear, traceable consent.
• Contractual clauses: sign a written agreement with the service provider (often called a “DPA” or data protection addendum) that: (1) specifies the hosting and backup locations, (2) governs service providers (an up-to-date list and the right to object), (3) imposes security standards, (4) provides for notice in the event of an incident, (5) requires deletion/restoration at the end of the contract, and (6) provides for audit rights.

Which service providers and tools are covered?

Any service that can store or process personal information may result in a transfer outside Quebec. Typical examples include:

• Office suites and email (e.g., Microsoft 365, Google Workspace), often with data-residency options in Canada, although technical support or logs may leave Quebec.
• Condominium management applications, request-ticketing systems and co-owner portals.
• Storage and file-sharing tools (e.g., SharePoint, Dropbox), cloud backups and archiving.
• “Cloud” video surveillance and access control in the common portions; some solutions record metadata outside Quebec.

The board of directors should ask for clear written answers: where are the primary and backup servers located? Who are the service providers? Which encryption keys are used, and who controls them? How are access logs and backup copies handled?

A practical process for your syndicate

Here is a practical sequence that a syndicate we support successfully followed to govern its transfers:

1. Map the information
   List the categories: co-owners, tenants, employees, applicants, suppliers and visitors. Link the documents to them: registers, minutes, financial statements, syndicate certificates, claims, maintenance files (maintenance logbook / EUC), contingency fund.

2. Identify data flows outside Quebec
   Identify where the data travels: email, storage, backups, mobile applications, ticketing systems, cameras, electronic-signature tools and payment gateways for common expenses.

3. Conduct the PIA
   Use an internal template to assess sensitivity, risks and measures. Keep the results and the decision in the board of directors’ minutes.

4. Choose the hosting option
   Prioritize data residency in Canada when available. If a transfer outside Quebec remains necessary, require safeguards equivalent to those under Quebec law (contracts, security and audits).

5. Update the contracts
   Sign a DPA with each service provider. Add clauses covering location, service providers, security, incident notice, the end of the contract, portability and secure deletion.

6. Inform individuals and, where necessary, obtain consent
   Update your privacy policy and forms (membership, lease and access requests). Provide clear notice for any communication outside Quebec.

7. Ongoing governance
   Officially appoint the PRP, train the board of directors and the condominium manager, maintain an incident register, and review the PIA and service-provider list annually.

To equip your board of directors, see our administrative management services, including support with documentary compliance: Services — administrative management.

Governance: policies, declaration of co-ownership and by-laws of the immovable

Your declaration of co-ownership does not always address the protection of personal information. We suggest adopting a privacy policy for the syndicate and, where necessary, supplementary by-laws of the immovable on file management (authorized access, retention, destruction, removable media and personal devices). Present these documents at the annual general meeting, have them approved when required, and archive them with the minutes.

Also consider the service-provider chain: external condominium manager, accountant, contractor responsible for maintaining the common portions, inspection firm for the maintenance logbook/EUC, and insurer. All should sign confidentiality commitments that comply with Bill 25 and with your clauses governing transfers outside Quebec.

Here is a summary checklist:

FAQ

Does Bill 25 prohibit the use of Google Drive, Dropbox or Microsoft 365?

No. Bill 25 does not prohibit these services, but it requires the syndicate to conduct a PIA, inform individuals, and govern the service provider and its service providers contractually. Prioritize data residency in Canada when offered and activate security controls.

Must written consent be obtained from every co-owner for a transfer outside Quebec?

Not always. When the use is necessary to administer the divided co-ownership (e.g., billing common expenses), the law may allow the communication if the required safeguards are respected. For sensitive information or non-essential uses, prioritize explicit and informed consent.

Do all data have to be brought back to Quebec immediately?

The law does not require automatic repatriation. It mainly requires a PIA, information and adequate safeguards. Use a contract renewal as an opportunity to strengthen the clauses and assess Canadian hosting options.

Useful resources:

• LégisQuébec — Act respecting the protection of personal information in the private sector (P-39.1), particularly section 17 on communications outside Quebec: official text.
• LégisQuébec — Civil Code of Quebec (general rules governing divided co-ownership, syndicates and registers): official text.
• LégisQuébec — Act to modernize legislative provisions as regards the protection of personal information (Bill 25): official text.
• RGCQ — Best practices in divided co-ownership and governance: RGCQ website.
• OACIQ — Personal information and brokerage in a condo sale (for coordination with the syndicate and notary): OACIQ website.

To explore more practical topics in condominium management, browse our blog and our services. You can also compare our packages based on the size and complexity of your building.

This article provides general information and does not constitute legal advice. Consult a lawyer or notary regarding your situation.

Do you manage a divided co-ownership in Quebec? Discover our packages or contact us to assess your needs.