Questions
Do I need a privacy impact assessment to use AI in Quebec?
Often, yes. Section 17 of Québec's private-sector privacy act says: "Before communicating personal information outside Québec, a person carrying on an enterprise must conduct a privacy impact assessment." Most AI services process data outside Québec, so sending client personal information to one generally triggers it, along with a written agreement. Section 3.3 separately requires an assessment for projects to acquire or develop an information system involving personal information. Confirm the analysis for your organization with counsel.
Last reviewed · 2 sources
What section 17 requires
The assessment must take into account "the sensitivity of the information", "the purposes for which it is to be used", "the protection measures, including those that are contractual, that would apply to it" and "the legal framework applicable in the State in which the information would be communicated".
The information may be communicated only "if the assessment establishes that it would receive adequate protection", and the communication "must be the subject of a written agreement" reflecting the assessment. The same applies when an enterprise entrusts a person or body outside Québec with collecting, using, communicating or keeping the information on its behalf.
Does replacing names avoid it?
Not by itself. The Act defines personal information as information that "directly or indirectly allows that person to be identified", and sets a high bar for anonymized information: it must be "reasonably foreseeable in the circumstances that it irreversibly no longer allows the person to be identified". A pseudonymized copy you can restore does not meet that bar for you.
What reducing identifiers does change is the assessment's inputs: less sensitive information, fewer identifiers, and a key that stays in Québec on your own computer. That can make the assessment easier to complete; it does not replace it.
Professional guidance
The Barreau du Québec's AI guidance tells lawyers to anonymize data and limit what they share to what is "strictement nécessaire" for the AI tool to accomplish its task.
Where PiBye fits
How PiBye handles this
PiBye does its detection, review and restoration on your Mac, in English and French, and keeps the key there. It reduces what an AI provider outside Québec receives and gives you a concrete account of what is shared for your assessment. It does not make an organization meet the Act; the assessment and the decision stay yours.
1.0.1 · macOS 14.8.5 or later · Apple Silicon · 1.1 GB
Frequently asked questions
Does section 17 apply to individuals using ChatGPT personally?
It applies to "a person carrying on an enterprise". Personal use is outside this page; professional and business use is where it matters.
Is this legal advice?
No. It quotes the Act as published on LégisQuébec. Your privacy officer or counsel should confirm how it applies to your practice.
Sources
- Act respecting the protection of personal information in the private sector (CQLR c P-39.1), LégisQuébec, Government of Québec, up to date as of June 10, 2026. Checked 25 September 2026.
- Foire aux questions : intelligence artificielle générative, Barreau du Québec. Checked 25 September 2026.