Quebec · Privacy guide
Quebec's Law 25: A Privacy Guide for Landlords
Landlords collect a lot of personal information: names, contact details, employment, references and payment history. In Quebec, Law 25 sets clear rules for how you collect, use, protect and dispose of it, whether you own one unit or fifty.
Applies to
Every Quebec landlord
Anyone who collects personal information about tenants or applicants in the course of renting.
Name a person responsible for personal information
Law 25 requires a person responsible for the protection of personal information. By default it is the person with the highest authority, which for most small landlords means you. Make that person's title and contact information available, for example on your website or rental documents.
Collect only what you need, with consent
- Tell applicants and tenants why you are collecting their information, at or before the time you collect it.
- Collect only what is necessary to assess an application or manage the lease.
- Get consent to use or share information for any other purpose, except where the law allows otherwise.
Protect it, and plan for incidents
- Use reasonable security measures: limit who can see tenant files, and keep digital records behind accounts with strong passwords.
- Keep a register of confidentiality incidents, such as a lost file or unauthorized access.
- If an incident presents a risk of serious injury, notify the Commission d'accès à l'information and the people affected.
Keep it only as long as needed
Once the purpose is fulfilled, for example an application you declined, destroy or anonymize the information in line with your retention rules. Tenants and applicants can also ask to see and correct the information you hold about them.
Screening and Law 25
Tenant screening is where landlords most often over-collect. Ask for what you need to assess the application, explain why, and let applicants know they can decline to provide information beyond that.
Frequently asked questions
Does Law 25 apply to a landlord with one unit?
Yes. It applies to anyone who collects personal information in the course of an enterprise, including renting out a single unit.
Who is the person responsible for personal information?
By default, the person with the highest authority. For most small landlords that is the owner, who can delegate the role in writing.
What counts as a confidentiality incident?
Unauthorized access, use or disclosure of personal information, or its loss, such as a misplaced tenant file or a compromised account.
Privacy built into your rental workflow
Automanagement uses role-based access so owners, tenants and contractors see only their own information, with encryption in transit and at rest. Available in English and Quebec French.
General information for landlords, not legal or tax advice. Rules change; confirm the current requirements with the Commission d'accès à l'information du Québec. Last reviewed 2026-09-28. Official source