Law 25 and data hosted in Québec: what a contractor must demand from their software
Where do your estimates, employees and clients live? Law 25 makes you responsible. The questions to ask any provider — and BatiCore’s answers.
Your estimates contain your clients' names and addresses. Your employee files contain SINs, hourly rates, sometimes accident files. Since Law 25, you — not your software provider — answer for that information. Which makes the choice of software a compliance decision, not just an efficiency one.
What Law 25 concretely requires from a contractor
- A designated person in charge of the protection of personal information (by default: the most senior executive — you).
- An incident register for confidentiality incidents, and the report to the Commission d'accès à l'information in case of a risk of serious injury.
- Framing transfers outside Québec: any communication of personal information outside requires a prior assessment (PIA) showing adequate protection.
- Answering requests for access and rectification from your clients and employees.
Your management software is your main data subcontractor: it holds everything. Hence the questions that follow.
The 5 questions to ask any provider
- "Where is my data hosted — country and precise region, not “in the cloud”?"
- "Which subcontractors touch my data, and in which countries? Is the list public?"
- "Does sensitive data (SINs, payroll, health/CNESST) leave Québec?"
- "Do you offer an incident register and tools to answer access requests?"
- "What happens at cancellation — exports, retention periods, destruction?"
A serious provider answers those five questions in writing. Silence is an answer.
BatiCore's answers, publicly
- Hosting in Canada, AWS Montréal region (ca-central-1): database, files, encrypted backups — everything.
- Payroll, health and SINs never leave Québec. No flow of that data to a third party, period.
- Subcontractors documented publicly — the list, with the country of each (transactional emails, payments, AI assistant on consent), lives on our privacy page and our Law 25 page.
- Built-in tools: confidentiality incident register ready to fill, tamper-evident audit log (hash chain), full exports at any time, framed purge at cancellation.
- The AI assistant runs on explicit consent, collected at sign-up — and the briefs sent are scrubbed of identifiable personal information.
Free 14-day trial, no credit card — create a real estimate today.
Frequently asked questions
Does Law 25 apply to a small construction business?
Yes. As soon as you hold personal information — client names and contact details, employee files, SINs for payroll — you have obligations: designate a person in charge, keep an incident register, frame communications outside Québec and answer access requests. The size of the business does not change the obligation.
Is it prohibited to use American software?
No — but any transfer of personal information outside Québec requires an assessment (PIA) showing adequate protection, and your clients must be informed. In practice: ask your provider WHERE the data is hosted and demand the list of its subcontractors. If it cannot answer, that is an answer.
Where does BatiCore host its data?
In Canada, in the AWS Montréal region (ca-central-1): database, files and backups. Payroll data, health data (CNESST files) and SINs never leave Québec. The few flows to third parties (transactional emails, payments, AI assistant on consent) are documented publicly on our privacy page, with the country of each subcontractor.
What is a confidentiality incident register?
A mandatory register (s. 3.5 and following) where the business records any incident involving personal information — loss, unauthorized access — with the assessment of the risk of serious injury and, where applicable, the report to the Commission d’accès à l’information. BatiCore provides this register built in, ready to fill.
We build BatiCore, management software for Québec construction contractors — estimates, job sites, CCQ payroll, compliance. Our articles cite dated public sources; when a fact comes from a regulator or a competitor, we say which one and when. Spotted an error? Write to us, we fix it.
Also worth reading
All articles →Prevention program or action plan: what the CNESST expects from a Québec construction company (2026)
Action plan due October 1, 2026, prevention program at 20 workers, job-site rules: who owes what in Québec construction, and where to start.
Read the articleGetting paid in Québec: notice of contract, legal hypothec and releases — the calendar not to miss
When to declare your contract, the 30 days to register the legal hypothec, the 6 months to preserve it, and what holdbacks and releases are really worth.
Read the article