What does Quebec's Law 25 require for employee training records?

Does Law 25 apply to employee training records?

Yes. The Act covers personal information a person collects, holds, uses or communicates in the course of carrying on an enterprise, whatever the medium (s. 1). A training record identifies a person: name, completions, scores, certification dates. Nothing exempts it because it belongs to an employee rather than a customer.

Two duties attach at the point of collection. The purposes must be determined before collecting (s. 4), and only the information necessary for those purposes may be collected (s. 5). For an LMS, that argues for enrolling the data a course actually needs rather than importing every HR field available.

Which LMS features help meet Law 25 duties?

No software makes an organization compliant: the Act makes the business that holds the information responsible for protecting it (s. 3.1). An LMS can still make a duty easier or harder to meet. The table below maps each duty to what to check the platform supports.

The Commission d'accès à l'information summarizes the assessment duty the same way: it covers any project to acquire, develop or overhaul an information system involving personal information.

Who is responsible for training data under Law 25?

By default, the person exercising the highest authority in the enterprise is the person in charge of the protection of personal information. The function can be delegated in writing, and the title and contact information of the person in charge must be published on the enterprise's website (s. 3.1).

The enterprise must also adopt governance policies and practices covering the keeping and destruction of personal information, staff roles across the information's life cycle, and a complaints process (s. 3.2). Training records held in an LMS fall inside those policies, including the question of who in the organization can see whose records.

How long can training records be kept under Law 25?

The Act does not publish a single retention period for training records, and this page will not invent one. It sets a floor and a ceiling instead.

The floor: personal information used to make a decision about a person must be kept for at least one year following the decision (s. 11). A completion record that supported a certification, a promotion or a termination is such information.

The ceiling: once the purposes for which the information was collected or used are achieved, it must be destroyed, or anonymized for serious and legitimate purposes, subject to any preservation period provided for by another Act (s. 23). Sector statutes and regulations can therefore extend the keeping of specific records. Which ones apply to you is a question for counsel, not for a vendor page.

Can training records be hosted outside Quebec?

Yes, conditionally. Before communicating personal information outside Quebec, the enterprise must conduct a privacy impact assessment covering the sensitivity of the information, its intended uses, the protection measures, and the legal framework of the receiving jurisdiction (s. 17). The communication may proceed only if the assessment establishes adequate protection, and it must be covered by a written agreement.

The same section applies when an enterprise entrusts a person outside Quebec with keeping information on its behalf. Choosing an LMS host is exactly that act, which is why the hosting region of a training platform is a Law 25 question and not just an IT preference.

What happens after a confidentiality incident?

The Act defines a confidentiality incident as unauthorized access, use or communication of personal information, or its loss (s. 3.6). When one occurs, the enterprise must take reasonable measures to reduce the risk of injury and prevent recurrence (s. 3.5).

If the incident presents a risk of serious injury, the enterprise must promptly notify the Commission d'accès à l'information and the persons concerned (s. 3.5). In every case it must keep a register of confidentiality incidents and send a copy to the Commission on request (s. 3.8). An LMS breach that exposes learner records walks straight into these sections.

Which rights do employees keep over their training records?

Access and rectification. On request, the enterprise must confirm a record exists, communicate it, and provide a copy; computerized information must be given as a written, intelligible transcript on request (s. 27). Information collected from the person must, on request, be communicated in a structured, commonly used technological format. If a record is inaccurate, incomplete or equivocal, the person can require rectification (s. 28).

Practically, this means an employer needs to be able to export one person's complete training history in a readable form, on demand.

How does EmbayLMS handle this?

EmbayLMS stores learning data at rest in AWS ca-central-1, the region located in Montreal, which keeps stored training records inside Quebec; the published carve-outs are transactional email and a US-hosted background worker tier. Training history can be exported by learner, course or date range, which is the shape an access request takes. Completion records survive account deactivation, which supports the one-year floor of s. 11 without keeping an account active.

This page summarizes statutory provisions in general terms as they read on the access date given for each source. It is not legal advice, and it does not state what the law requires of your organization. Consult a lawyer about your own obligations before you rely on it.