Québec Law 25 — Privacy Impact Assessments, Access Requests and Incident Notices (full edition)

Respond within the deadline, or know that you did not

A request for access, rectification or portability starts a time limit running. The source states that failure to respond is deemed a refusal: the time limit is therefore not a formality, it is a decision made by inaction.

The module dates the receipt, calculates the deadline, schedules an activity as it approaches, and records afterward whether the response was logged in time. It does not say you are in default: it reminds you what the source says about this situation.

The deadline is not in the code

It comes from the delai_reponse_demande record supplied by the free edition, with the URL of its primary source and the date it was consulted. If the value changes, it is corrected from the screen, with no code release — and the due date of every request follows.

And if this value is deleted or marked “value not found”, the deadline stays empty. A deadline calculated from a guessed time limit would be worse than no deadline at all: people would rely on it.

The breach notice and its six elements

The notice to the affected individual must contain six elements, and the source lists them: the information concerned, the circumstances, the date or period of the incident, the measures taken to reduce the risk, the measures suggested to the individual, and the contact details of a person to contact.

The module refuses to generate a notice that is missing an element, and it names which one. Five elements out of six is an incomplete notice that looks like a notice.

Once sent, the notice can no longer be rewritten. It is what the person received: correcting it afterwards would make the register say the text sent was the new one. The acknowledgment of receipt, on the other hand, can always be recorded — by definition it arrives after sending.

The privacy impact assessment

The source names three projects — acquisition, development or overhaul of an information system or electronic service delivery system — and requires the involvement of the person in charge from the outset. The module handles all three types, makes the person in charge mandatory, and compares the date of their involvement with the project start date.

No official questionnaire was found. Searched on September 14, 2026 on the website of the Commission d'accès à l'information (Québec's access-to-information and privacy commission): it describes when the assessment must be carried out, but does not publish a mandatory template. The twenty-one questions provided are therefore all marked “unofficial” with their written disclaimer. This is a starting list, not a regulatory form in disguise.

Retention is counted from the date of awareness

Five years from the date the company became aware of the incident, not from the incident itself. It is the most natural mistake, and it shortens the retention period by however late the discovery was.

The module calculates the minimum retention date, displays it, and refuses deletion of an incident that is still covered — citing its source, and offering archiving, which preserves instead of erasing.

The Commission offers no interface, and the module says so

Checked on September 14, 2026: the Commission d'accès à l'information (Quebec's access-to-information commission) provides an incident notice form, and nothing else. No endpoint, no documentation, no token, no sandbox.

The dyo_connexions_base source chain therefore puts manual tracking first, and active on delivery. This is not a fallback: it is the normal path. The “automatic interface” source ships inactive and always answers “unavailable” with the reason in writing — it exists to name the absence, so that no one searches endlessly for an option that does not exist. The day the Commission opens one, its URL and key are entered on screen and it moves to the front.

The module records findings; it does not draw conclusions

It says that the deadline has passed with no recorded response. It does not say that the risk of harm is significant, or that the company is in default. These judgments are assessed, with advice.

Not proven in production. No notice produced by this module has been filed with the Commission d'accès à l'information (Quebec's access to information commission).

Also searched as: Odoo PIA (ÉFVP), Law 25 privacy impact assessment (EFVP), évaluation des facteurs relatifs à la vie privée, Quebec personal information access request, CAI incident notice, Law 25 data portability, privacy impact assessment Quebec Odoo.