Law 25 and Client Data: What Every Broker Must Know
Last verified:
In brief — Law 25 applies to any private enterprise that handles personal information — agencies and brokers included. Each enterprise must designate a person responsible for the protection of personal information; by default, the permit holder is individually responsible, unless they delegate the role. In 2026, all provisions (those from September 2023 and September 2024) are in force.
A broker — real estate or mortgage — handles some of the most sensitive data: contact details, ID documents, income, financial files. Law 25 frames that responsibility.
Who Law 25 applies to
Law 25 targets private enterprises that collect, hold or use personal information in their activities. Agencies and brokers are among them: protecting personal information is now an integral part of their professional obligations.
The privacy officer
The law requires designating a person responsible for the protection of personal information. By default, each permit holder is individually responsible, unless the responsibility is assigned to another person. That officer's name and contact details must be accessible.
What is in force in 2026
All of Law 25's provisions now apply: those that came into force in September 2023 and those from September 2024. In practice, a broker must be able to:
- explain what information they collect and for what purposes ;
- obtain clear consent where required ;
- protect information with reasonable security measures ;
- manage confidentiality incidents and respect individuals' rights (access, correction, etc.).
Concrete best practices
- Limit collection to the strict minimum and retention to the useful period.
- Restrict access to files to those who need it.
- Secure the transfer and storage of documents (no sensitive items over unprotected channels).
- Keep an incident log and know what to do in case of a breach.
How DeedWorth handles data
Our approach to security and privacy is described on our security and privacy pages: delegated authentication, no card data stored, restricted access, no sale of information.
FAQ
Does Law 25 apply to brokers? Yes. It targets any private enterprise that handles personal information, which includes agencies and brokers.
Who is the privacy officer? Each enterprise must designate one. By default, the permit holder is individually responsible, unless the responsibility is assigned to another person.
Which provisions are in force in 2026? All of them: those from September 2023 and those from September 2024 now apply.
What information must a broker protect? The sensitive personal information they handle: contact details, ID documents, income and financial files, at every stage.
Read more
For information only, not legal advice. Rules change; confirm your obligations with the Commission d'accès à l'information du Québec or a professional. Last verified: July 2026.