If ChatGPT already saves you time, these three steps take about an hour, with no IT department and no corporate policy.
Law 25 protects anything that can identify a client
Law 25 modernized the Act respecting the protection of personal information in the private sector. Its section 2 covers any information about a person that directly or indirectly allows that person to be identified.
A name with an address, an invoice, an appointment note: all of it counts. The question is never "may I use ChatGPT?" but "what am I pasting into it?"
Step 1: you are the person in charge, and your website must say so
Under section 3.1, the person with the highest authority in the business is in charge of protecting personal information. In a small business, that's you.
You can delegate the role in writing, for example to a trusted employee. The title and contact details of the person in charge are published on your website, or made available another appropriate way if you have none.
The line to copy
Person in charge of protecting personal information: First Last, owner. Email: you@yourbusiness.ca. Phone: your number.
Add it to your privacy page or your website footer. It takes a few minutes.
Step 2: no identifiable client data goes into a public AI tool
When you paste text into ChatGPT, it goes to the provider. If that provider processes it outside Québec, even elsewhere in Canada, section 17 first requires a privacy impact assessment.
That assessment is an analysis of the risks to your clients' privacy. The simplest rule is to put nothing in that identifies anyone.
Example
Instead of: "Follow up with John Smith, 12 Maple Street, about his June invoice."
Write: "Draft a polite reminder for a client whose June invoice is overdue."
Replace names with "the client" and addresses with "the property". Also remove what could give the person away: an exact date, a file number, an unusual situation.
Many tasks need no client data at all. Our article on admin tasks you can automate with AI suggests several.
Step 3: a business account, not a personal one
When you use ChatGPT for your business, OpenAI acts as your provider. Section 18.3 of the law requires a written contract with any provider that handles personal information for your business, and that contract must protect the information.
A free personal account, opened with your personal email, is set up for an individual, not for your business. ChatGPT Business and Enterprise accounts are opened in your business's name, and OpenAI states on its business data page that, by default, it does not use their data to train its models, meaning to improve ChatGPT.
Keeping a personal account for now? At least do this: Settings, then Data controls, then turn off "Improve the model for everyone". Your conversations will no longer be used for training. It takes a few minutes.
The same goes for Microsoft Copilot, Google Gemini or an assistant built into your software: before putting client information into it, ask the provider in writing whether your data is used to train its models.
Where do you stand with ChatGPT and Law 25?
Tick what is already true for you. A self-check, not legal advice; nothing is sent.
Tick the statements to see your result.
Three uses of AI still call for caution
- The machine decides alone. Under section 12.1, a decision based exclusively on automated processing must be disclosed to the person. Say a tool declines quote requests on its own: simplest fix, you approve each decision.
- The data changes purpose. Under section 12, information is used only for the purposes it was collected for, unless the person consents. Mining your billing data for marketing therefore needs, in principle, the client's consent.
- A new tool touches your client files. Under section 3.3, any project to acquire or develop an information system involving personal information first requires an assessment. Do it before connecting the tool, not after.
For sensitive files, private AI keeps everything in-house
Private AI is an AI model installed on infrastructure reserved for your business. Your data goes through no public AI service.
It suits clinics, accounting firms, lawyers and other professional services. They handle health files, tax returns or confidential contracts.
With private AI, AI agents can summarize a file or sort your email without your data leaving your infrastructure. To budget for it, see what an AI agent costs a small business.
This article is for information only and is not legal advice. For your situation, consult a professional. The official reference is the Commission d'accès à l'information.
Frequently asked questions
Does Law 25 ban ChatGPT?
No. The law names no tool: it governs how you collect, use and communicate personal information. ChatGPT remains fine for brainstorming, drafting an offer or correcting a text with no client data.
I run my business alone: am I covered?
Yes, if you hold information about clients: names, addresses, invoices, appointments. According to the APCHQ, the law applies regardless of business size. Business contact details of your professional contacts (name, function, work email) are excluded, however.
Can I use ChatGPT with anonymized data?
Yes, if it truly is anonymized. Under section 23, it must be reasonable to expect that the data irreversibly no longer allows the person to be identified. Removing the name isn't enough.
What if I pasted client data by mistake?
Limit the damage first. Section 3.5 requires reasonable measures to reduce the risk of harm, and the incident goes in your incident register. You notify the CAI and the people concerned only if there is a risk of serious harm.
My tool stores data in Canada: is that enough?
No. For section 17, Canada is outside Québec. Before communicating personal information there, a privacy impact assessment is required. The communication is allowed if the information would receive adequate protection.