Screening candidates under Quebec’s Law 25: what to settle before you switch on AI

Quebec’s private-sector privacy act, as amended by Law 25, applies to any business that collects personal information about people in Quebec. If you recruit for positions in Quebec, or receive applications from Quebec residents, it applies to your hiring. Software that reads résumés, asks screening questions or scores interviews touches it in five places.

1. Know whether any decision is made by software alone

When a decision about a person is based exclusively on automated processing of their personal information, the law requires you to tell them, and, if they ask, to explain the information and the reasons behind it and let someone review the decision.

The simplest way to stay clear of this is to make sure no decision is made by software alone. A tool may sort applications or suggest a score; a person looks at the application and records their own reason for advancing or rejecting it. Ask your vendor whether the product lets anything reject a candidate without a person, and what it records when a person decides.

2. Assess before information leaves Quebec

Before personal information is communicated outside Quebec, the law requires an assessment of the privacy impacts: how sensitive the information is, why it is being sent, how it will be protected and the legal framework of the place it goes. The protection has to be set out in a written agreement.

“Outside Quebec” includes other provinces. A recruitment platform hosted in Toronto, an AI model run in the United States and an email service in another country are all transfers to assess. Ask your vendor for a list of where each kind of information is stored and processed.

3. Assess new systems before you adopt them

A privacy impact assessment is required for any project to acquire, develop or overhaul an information system that handles personal information. Buying recruitment software is such a project. The assessment does not have to be long, but it has to be done before the system is used, and it should be kept current when the system changes.

4. Check the defaults

Functions that can identify, locate or profile a person must be turned off by default, and people have to be told about them. Products must offer the highest level of confidentiality by default.

In recruitment, profiling can include reusing a candidate’s profile for other jobs, comparing applicants with one another, or matching people in a talent pool against new openings. Ask your vendor which functions profile, how they are configured out of the box, and who can turn them on.

5. Post in French

Job offers for work in Quebec must be published in French. A version in another language may be published at the same time, but not before. Requiring knowledge of a language other than French is allowed only when the duties need it, and only after the employer has taken reasonable means to avoid it. Since June 1, 2025, businesses with 25 or more employees in Quebec also have francization obligations.

One more thing: name your person in charge

Every business has a person in charge of the protection of personal information. By default it is the person with the highest authority in the business, unless that role is delegated in writing. Candidates should know how to reach that person.

How we approach it

TalentInitiator records a person’s reason for every disposition, keeps profiling functions off by default in Quebec mode, requires a transfer assessment before the live AI service is turned on for a Quebec organization, and publishes French and English postings together. The details are in our Law 25 explainer.