Anonymizing data under PIPEDA and Quebec Law 25

Which law applies to your data

If you move personal information across provincial or national borders, PIPEDA is the default rule. It treats any data that could identify an individual, on its own or when combined with other data, as personal information.

When the people whose data you handle live in Quebec, Law 25 adds its own anonymization regulation (Regulation respecting the anonymization of personal information, A-2.1, r. 0.1). That rule demands a very low residual-risk test before the data stops being personal.

How the two regimes test anonymization

PIPEDA uses an identifiability test. The data must not give a reasonable person a serious chance of identifying someone. If you can still piece together a name, address, or employee number, the data remains personal. Consent is required unless an exception applies, so you either inform the individuals that you may disclose their data or you strip the personal information first.

Quebec's Law 25 sets three hurdles:

1. No individual can be singled out from the set.
2. Records cannot be linked together to re-identify a person.
3. No new facts about a person can be inferred after anonymization.

To satisfy those hurdles you must define the purpose of the anonymization, have a qualified person supervise the process, remove direct identifiers (names, IDs, contact details), and run a re-identification risk analysis both before and after cleaning. Record the analysis in a register that can be inspected later. If the residual risk is "very low" and not reasonably foreseeable, Quebec treats the data as anonymized.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

What regulators expect

The Office of the Privacy Commissioner of Canada enforces PIPEDA, while Quebec's Commission d'accès à l'information enforces Law 25. Both bodies want a written record of every de-identification step and proof that the risk tests were met.

When you intend to export cleaned data out of Quebec, the regulator requires a written privacy impact assessment and a contract that mirrors the assessment's findings. PIPEDA does not forbid cross-border transfers, but it expects you to stay accountable and to use contracts that provide comparable protection.

A quick self-check you can run

Grab a small sample, say ten support-ticket records. Strip obvious identifiers: names, email addresses, employee numbers. Then hand the sample to a colleague who does not work with the data and ask them to try re-identifying any individual using only publicly available information. If they succeed, the dataset has not passed either jurisdiction's test.

How our de-identification service fits

We run a stand-alone de-identification service that mirrors the steps above. First we map the systems you use and the applicable laws. Next we export the raw files to an isolated, logged workspace and delete the originals on a recorded date. Automated tools replace names with stable pseudonyms such as "employee 632" and strip dates, locations, and numbers as required. A trained reviewer then validates the cleaned files and performs a re-identification test. You can read more about the process on our de-identification page.

We quote each project after we know the volume and the systems involved. The fee is paid by the customer, whether or not the data later enters a licensing deal. In most licensing transactions the AI lab that buys the data covers the de-identification cost, but the exact arrangement is negotiated case-by-case. We do not claim any certification, and we do not act as an independent third-party auditor.

What to do next

If you run a 70-person manufacturing firm in Quebec and want to license your support-ticket archive to a large AI lab, start by requesting a de-identification quote from us. The button below will open a short questionnaire; you do not need to send any data at this stage. After we receive your answers, we will prepare a project-specific quote and explain how we will meet both the PIPEDA and Quebec risk tests you need to satisfy. When you are ready to move forward with licensing, you can review the steps on our sell page and even check an offer to see who will handle the personal-information removal.