Parcel Lockers in Co-ownership and Quebec Bill 25

Deliveries are soaring and entrance halls are overflowing. Smart parcel lockers promise to reduce theft, losses and delivery attempts. In divided co-ownership, however, implementing them raises sensitive legal and technological issues. Bill 25 imposes strict rules on personal information. The board of directors must therefore balance operational efficiency with compliance.

Information current as of 2026-08-02.

In this article, you will learn how to assess a parcel locker project, understand your obligations under Bill 25, establish requirements for the supplier and inform co-owners. You will come away with a practical list of steps for deploying an effective, privacy-conscious system.

Why install parcel lockers in a condo, and what are the issues?

Parcel lockers address a common nuisance in the common portions. They secure deliveries, reduce the number of parcels left on the floor and free up time for the superintendent or condominium manager. Residents can retrieve their deliveries on a self-service basis, without involving the board of directors.

These benefits come with practical considerations. You need to plan for space in the common portions, access for delivery personnel, an electrical supply and, sometimes, network connectivity. The by-laws of the immovable must establish rules for use, hours, the handling of unclaimed parcels and responsibility in the event of damage. Ideally, adopt or ratify these rules at the annual general meeting, then record the decisions in the minutes.

Financially, the purchase, installation and maintenance are added to the common expenses. The syndicate must include the solution in its operational planning and ensure that the maintenance contract meets its needs. Communication with co-owners remains essential to prevent misunderstandings and disputes.

Bill 25: what the board of directors needs to know before installing lockers

Bill 25 modernizes Quebec’s personal information protection framework. For a syndicate deploying smart parcel lockers, this includes the following elements, among others (see the Act respecting the protection of personal information in the private sector, chapter P-39.1, LégisQuébec):

• Designate a person responsible for the protection of personal information within the syndicate, often a member of the board of directors.
• Clearly inform the individuals concerned about the information collected, the purposes, the means used and their access and rectification rights.
• Apply data minimization: collect only the information needed to operate the lockers (e.g., name, unit number and notification method).
• Put security measures in place that are proportionate to the risks (authentication, encryption, access logging and access controls).
• Establish limited retention periods and secure destruction mechanisms.
• Govern any transfer outside Quebec or use of external suppliers through appropriate assessments and contractual clauses.
• Document and handle any confidentiality incident, and notify the affected individuals and the appropriate authorities when required by law.
• Carry out a privacy impact assessment for any project involving the acquisition, development or redesign of an information system that processes personal information.

Refer to the official text of the Act respecting the protection of personal information in the private sector (P-39.1) for detailed obligations and definitions. The Civil Code of Quebec is also relevant when establishing the syndicate’s decisions and the use of the common portions.

Useful resources:

• LégisQuébec – Act respecting the protection of personal information in the private sector (P-39.1)
• LégisQuébec – Civil Code of Quebec (C.C.Q.)

Choosing and configuring a compliant smart parcel locker

A “smart” parcel locker inevitably processes personal information. The choice of supplier and system settings can make the difference between a smooth project and an unnecessary risk.

What data is involved?

Depending on the system, the following information is typically involved:

• User identifiers (name, unit number, email address or telephone number for notifications);
• PINs, QR codes or unique links for delivery;
• Access and locker-opening logs, with timestamps;
• Potentially, images if the locker includes a camera or is within the range of an existing camera in the common portions;
• Contact information for delivery partners, if integrated.

The guiding principle remains necessity. Avoid activating modules that do not serve the delivery objective. For example, do not use geolocation if a unique, limited-use code is sufficient.

Recommended settings and technical requirements

• Authentication and permissions: make sure that only authorized syndicate managers can access the administration system. Give preference to multifactor authentication.
• Hosting and location: favour hosting in Canada where possible. If hosting takes place outside Quebec, assess the risks and govern the transfer by contract.
• Logging and retention: retain logs for as long as necessary to manage disputes and security, then destroy them securely.
• Notifications: send concise notices without excessive information. An option to withdraw from notifications must be provided if they are optional.
• Network and physical security: encryption in transit, regular firmware updates, and access control for the electrical room and locker room.
• Integrations: if the locker connects to the intercom, access control system or camera server, verify compatibility and the impact on privacy.

For the electrical installation, hire a contractor holding the appropriate licences. Also verify the compliance requirements applicable to the equipment.

Governance, contracts and communication with occupants

Compliance does not stop at the technology. It is reflected in your policies and agreements.

• By-laws of the immovable: specify the terms of use, hours, the syndicate’s responsibility, the handling of expired parcels and the prohibition against storing hazardous materials. Have the rules ratified at the annual general meeting and attach the text to the minutes.
• Privacy policy: describe the data processed by the lockers, the purposes, retention periods and residents’ rights. Make it accessible through the extranet or information notice.
• Supplier contract: define roles and responsibilities, security measures, assistance in the event of an incident, subcontractors, hosting, audits, data reversibility and deletion at the end of the contract. Require advance notice of any major change.
• Transfers outside Quebec: if the supplier hosts the data elsewhere, document the privacy impact assessment, safeguards and applicable legal framework.
• Training and access: limit access to employees or directors who need it. Offer residents a short training session and guide.
• Transparency: post a notice near the lockers summarizing the purposes and contact information of the person responsible for the protection of personal information.

For operations and seasonal reminders, a management partner can support you. See our operational and administrative service areas, as well as our blog resources.

• Services – operations management
• Services – administrative management
• multiRent blog

Implementation: practical steps for your syndicate

Here is a simple framework for structuring your project.

1. Define your needs: parcel volume, space constraints, delivery access and the risks to be addressed.
2. Map the data: who collects what, where, for how long and why.
3. Check Bill 25: designate the responsible person, prepare information for residents, and establish retention and destruction procedures.
4. Assess three solutions: compare hosting, security, ease of use and integration with your systems.
5. Plan the installation: electrical supply, network, anchoring, and protection against moisture and vandalism.
6. Establish rules through the by-laws of the immovable: draft, consult, adopt and record the text in the minutes.
7. Negotiate and sign the supplier contract: include the confidentiality and security clauses required by Bill 25.
8. Conduct testing: codes, notifications, delivery access, power outages and exception scenarios.
9. Launch and inform: communicate the instructions, publish the policy, and train staff and the board of directors.
10. Monitor and improve: address incidents, track access requests, review settings as needed and conduct an annual audit.

FAQ – Parcel Lockers and Bill 25

Q1. Can the locker area be filmed?

Yes, if there is a serious security-related reason and the use complies with data minimization. Post a visible notice, limit the field of view, control access to the images and shorten the retention period. Avoid capturing the inside of the lockers.

Q2. Who has access to locker data?

Only people who need it to administer the service, with strict access rights. Residents have access and rectification rights regarding their personal information. The supplier acts only in accordance with the syndicate’s contractual instructions.

Q3. Is written consent from residents required?

When collection is necessary to provide the parcel delivery service, clear information and a valid legal basis may be sufficient. Explicit consent is required for unnecessary secondary uses, such as sending promotions.

This article provides general information and does not constitute legal advice. Consult a lawyer or notary for your situation.

Do you manage a co-ownership in Quebec? Explore our plans or contact us to assess your needs.