Privacy compliance · · By Stratechno
Does Law 25 require cybersecurity or privacy awareness training?
Yes, but not in the same way for every sector: explicit for public bodies (s. 63.3), it flows from the duty to take reasonable security measures for private companies (s. 10).
Short answer
Yes, but not in the same way depending on your sector. In the public sector, Law 25 is explicit: section 63.3 requires public bodies to include, in their governance rules for the protection of personal information, a description of the training and awareness activities offered to staff. In the private sector, awareness is not named: it flows from the duty to take reasonable security measures to protect personal information (section 10).
In other words: a private organization may not have a formal "awareness program", but it must be able to show that its staff know how to protect the information they handle. In practice, it is the same requirement with a different level of formality.
The 30-second answer
Applicable law
Public sector: Act respecting Access to documents held by public bodies and the Protection of personal information (A-2.1). Private sector: Act respecting the protection of personal information in the private sector (P-39.1).
Is awareness named?
Public sector: yes, in section 63.3. Private sector: no.
What is required
Public sector: published governance rules describing the training and awareness activities offered to staff. Private sector: reasonable security measures (s. 10) and governance policies (s. 3.2).
Where it shows
Public sector: in the governance policy or rules published on the website. Private sector: in the measures actually implemented and documented.
Expected proof
Public sector: the description appears in the governance rule. Private sector: the ability to demonstrate that measures are adequate and carried out.
Risk if missing
Public sector: incomplete governance rule. Private sector: measures deemed insufficient, especially after an incident.
What Law 25 really changed
Law 25 did not create a new law: it reformed the two existing regimes - public bodies (A-2.1) and businesses (P-39.1) - with staggered entry into force between 2021 and 2024. The key governance obligations (person in charge, policies and practices, public bodies’ governance rules) have applied since September 22, 2023. As a result, awareness is no longer a peripheral HR topic: it is a governance matter that is documented, tracked and can be shown.
Public sector: an explicit obligation (section 63.3)
Section 63.3 states that governance rules must provide for the roles and responsibilities of staff throughout the life cycle of the information and a complaint process, and that they include a description of the training and awareness activities the body offers its staff on the protection of personal information.
The governance rule must contain it
Not an internal HR plan or a memo: the policy, directive or guide published on the body’s website.
Approved and published
The rules are approved by the committee on access to information and the protection of personal information, then published.
Private sector: not explicit, but hard to avoid (section 10)
No section of the private sector act uses the word "awareness". Yet section 10 requires businesses to take security measures that are reasonable given the sensitivity, purpose, quantity, distribution and medium of the information. The law sets a standard of reasonableness and leaves the business to demonstrate it - this is where awareness comes in.
The word "training" appears only once, in section 3.4 (4°): during an information system project, the person in charge may suggest training activities for project participants. Training is treated as one measure among others, not a standalone obligation.
The human factor is the leading cause of incidents
A security policy nobody applies is a document, not a measure. Awareness turns written rules into behaviour.
Section 3.2 requires roles and responsibilities
Roles that staff do not know about are not really assigned.
The CAI lists awareness among security measures
Its incident prevention guide gives the example of a phishing awareness campaign and asks organizations to measure its effect.
What an awareness program should cover
A policy that names awareness
The section 63.3 description in the public sector; the measure set out in your governance policies in the private sector.
An identified person in charge
Person in charge of the protection of personal information (s. 3.1) or the designated person in the public body.
A continuous program, not an event
Onboarding, short regular reminders, phishing simulations, role-based content.
Measurable proof
Participation rates, simulation click rates, trends over time, content dates and versions.
An improvement loop
Incidents, reports and simulation results feed next year’s content.
A documented annual review
Presented to management or the committee - this is what turns an activity into governance.
Four costly mistakes
1. A policy that promises more than the program delivers
Describing activities that do not happen is riskier than describing none.
2. One annual training session
Reflexes fade and phishing evolves faster than training calendars.
3. Awareness without a trail
Without records, simulation reports and dated versions, the measure cannot be shown to exist - or to be reasonable.
4. Awareness reserved for IT
Personal information mostly flows through HR, finance, customer service and sales - the teams that most often trigger incidents.
FAQ
Does Law 25 set a number of training hours?
No. Frequency and duration must be proportionate to the risks and the information processed.
Are non-profits and small businesses covered?
Yes, as soon as they process personal information while carrying on an enterprise: there is no size threshold.
Are cybersecurity awareness and privacy training the same?
No, but they complement each other: privacy training covers legal rules and rights; cybersecurity awareness covers behaviours such as phishing, passwords and reporting. A mature program covers both.
How long does it take to set up a program?
With modern tools, an awareness program can be deployed in just a few days.
How Stratechno can help
Our cybersecurity awareness service
Stratechno designs and runs cybersecurity awareness programs for Quebec organizations, in French and English - phishing simulations, short training, knowledge tests on your own domains and a human maturity report.
Sources: A-2.1 s. 63.3 and P-39.1 ss. 3.1, 3.2 and 10 (LégisQuébec); Government of Quebec and Commission d’accès à l’information guidance. This article is a general analysis and does not constitute legal advice.