Bill 25 and Divided Co-ownership: Privacy Incidents

Bill 25 modernizes the protection of personal information in Quebec and also applies to your divided co-ownership syndicate. A privacy incident can happen faster than you might think: an email sent to the wrong recipient, a lost list of co-owners, or the theft of a laptop containing minutes. Your board of directors (board) must know how to respond, provide notice and keep proper records.

Current note: up to date as of 2026-06-02.

What is a privacy incident in divided co-ownership?

Under Bill 25, a privacy incident involves unauthorized access to, use of or communication of personal information, or the loss of such information. In divided co-ownership, this often concerns information such as names, email addresses, telephone numbers, banking details for condo fee withdrawals, insurance claim files or complaints recorded in the register.

Typical examples in a condo building:

• An Excel file from the co-owners’ register is mistakenly sent to all residents.
• A binder containing work requests and contact information disappears from the board’s office.
• An external condominium manager is hit by ransomware that encrypts the co-ownership files.
• An email containing medical information mentioned in a complaint circulates outside the board.

When an incident occurs, the primary concern is to limit the risk of serious harm to the people concerned (e.g., fraud, identity theft or reputational harm).

Useful references:

• Text of the Act respecting the protection of personal information in the private sector (LégisQuébec): P-39.1
• Provisions concerning the syndicate and co-ownership registers (Civil Code of Quebec): CCQ-1991

Board responsibilities and policies required by Bill 25

• Person responsible for personal information (PRP): by default, the syndicate’s highest-ranking authority (often the board chair). The board may designate and publish this person’s identity or title and contact information (on a website, by posting or through communication to co-owners).
• Internal policies: adopt governance policies for the protection of information (minimal collection, use, retention and secure destruction), a privacy impact assessment process for high-risk projects, and contractual clauses with your service providers (management, IT and concierge services) governing personal information.
• Privacy incident register: keep an up-to-date register ready to be provided to the Commission d’accès à l’information (CAI) upon request. This register is separate from the general co-ownership register referred to in the Civil Code of Quebec.
• Training and access: give clear instructions to directors and the condominium manager. Limit access to files containing personal information to people who need it to perform their duties.

To structure these measures, see our administrative management services and our financial management support for rigorous record-keeping.

For an overview of best practices in divided co-ownership, consult the RGCQ. For the brokerage sector, the OACIQ addresses the protection of personal information, with principles that can be applied to your syndicate’s context.

Incident procedure: 5 key steps

1) Contain and secure

• Isolate the affected system or file. Change passwords and suspend any suspicious access.
• Retrieve the document sent by mistake, if possible. Request its deletion and obtain confirmation.

2) Assess the incident

• Describe what happened, the information involved and the people potentially affected.
• Assess the risk factors for serious harm: the sensitivity of the information, the number of people, the likelihood of malicious use and the mitigation measures already taken.

3) Decide which notices are required

• If there is a serious risk of harm, you must notify the people concerned and the CAI without delay. Also notify any organization that may be able to reduce the risks (e.g., a financial institution or insurer) without disclosing more than necessary.
• If the risk is low, document the event in the register nonetheless and implement corrective measures.

4) Document the incident in the register

• Record the incident, the date, the nature of the information, the decisions made, the notices sent and the mitigation measures.

5) Correct and prevent

• Adjust your policies, strengthen access controls, encrypt your media and train your team. If needed, plan a reminder at the annual general meeting without sensitive details to explain the governance improvements.

Practical tip for the board:

• Centralize sensitive data in a secure location.
• Avoid distributing personal information in the minutes; create confidential appendices when required.
• Apply the minimization principle: collect only what is necessary to administer common expenses, the contingency fund study/maintenance logbook, insurance claims and enforcement of the by-laws of the immovable.

Notices to affected people and the incident register

When the serious-harm threshold is met, the notice to affected people and the notice to the CAI must be complete and prompt. The exact content is set out in Bill 25; use the elements below as a starting point and adapt them to your situation.

Minimum notice content

• A brief description of the incident and the date or period concerned.
• Categories of information involved (avoid listing individual data in the notice).
• Potential risks (e.g., fraud) and mitigation measures implemented.
• Recommended measures for the people concerned (e.g., vigilance, changing passwords or a credit alert).
• Contact information for the PRP for questions and follow-up.

Notice channels: an individually addressed email, letter, telephone in urgent cases or another method appropriate to the situation. Keep proof that the notices were sent.

For regulatory notification and the criteria for “serious harm,” refer to the legislation (LégisQuébec): Act P-39.1.

Incident register: what to record

• The nature of the incident and the systems/files affected.
• The type of personal information involved.
• The approximate number of people concerned.
• The assessment of the risk of serious harm and the decision regarding notices.
• The notices sent (to the CAI, people concerned and third parties) and the dates.
• The corrective measures implemented.

Retention and access: keep the register securely and separately from the general register required under the Civil Code of Quebec. Access is restricted to the PRP, the board and, where necessary, the duly authorized condominium manager. Under the Civil Code of Quebec, a co-owner’s right to consult the registers does not extend to confidential sections containing third-party personal information; instead, offer a non-identifying summary on a case-by-case basis to comply with both the declaration of co-ownership and Bill 25. See the Civil Code of Quebec for the rules concerning the registers and life in divided co-ownership.

For additional tools, also consult the multiRent blog and our service packages for structured support.

Frequently asked questions about divided co-ownership (FAQ)

Q1. Do we have to inform all co-owners if only a few people are affected?
– Inform only the people concerned when a serious risk of harm has been established. Avoid over-disclosure. If needed, share a general, non-identifying message at the annual general meeting about security improvements.

Q2. Should the incident be recorded in the board or annual general meeting minutes?
– Yes, but very briefly and without personal information. Note that “the board handled a privacy incident in accordance with the policy” and indicate the corrective measures. Sensitive details remain in the incident register.

Q3. A service provider (e.g., a condominium manager) experienced a breach. Who gives notice?
– The service provider must notify you promptly. As the person responsible for the co-ownership’s information, the syndicate’s PRP decides on notices to the CAI and the people concerned. Include these obligations in your service contracts.

Q4. Do we need consent to disclose information to the insurer after an incident?
– Bill 25 allows communication without consent when it is necessary to prevent or mitigate serious harm. Disclose only what is essential and document it in the register.

For more information, also see the resources of the RGCQ and the real estate sector’s guidelines on protecting information from the OACIQ.

This article provides general information and does not constitute legal advice. Consult a lawyer or notary for your situation.

Do you manage a co-ownership in Quebec? Explore our service packages or contact us to assess your needs.