Privacy access requests under Law 25: an AI agent to reply within 30 days
“Can you send me everything you have about me?” Since Quebec’s Law 25, a customer, an employee or a former employee can ask any Quebec business that question. The problem is rarely bad faith. It’s that the request lands in the info@ inbox on a Friday, nobody knows who should handle it, and the information is scattered across email, the CRM, accounting and a shared folder.
The Act only allows 30 days. Privacy access requests are a good example of a task an AI agent makes simpler: it spots, sorts, searches and prepares, while your person in charge of the protection of personal information keeps every decision. Here’s how.
What the Act requires when a request comes in
Quebec’s Act respecting the protection of personal information in the private sector governs access and correction requests. The rules are clear, but there are many of them:
| What the Act provides | Section | What it means for you |
|---|---|---|
| The request is made in writing, by a person proving their identity, and addressed to the person in charge of the protection of personal information | 30 | You need to recognize a request even when it lands in the general inbox or comes through the contact form. If it’s unclear, the person in charge helps the requester make it more precise. |
| A written reply, with diligence, no later than 30 days after receipt | 32 | With no reply within the deadline, the request is deemed refused, and the person can turn to the Commission d’accès à l’information. |
| Confirm the information exists, provide a copy and an intelligible transcript | 27 | Computerized information collected from the person is given back, on request, in a structured, commonly used technological format. |
| Access is free; reasonable fees are possible for transcription, reproduction or transmission | 33 | The approximate amount must be announced before the request is processed. |
| A refusal gives reasons, cites the provision of the Act and states the recourse and its deadline | 34 | The person has 30 days to challenge the refusal before the Commission (s. 43). |
| Correction of inaccurate, incomplete or equivocal information | 28 and 35 | After the correction, the person receives, free of charge, a copy of the modified information or a certificate confirming its deletion. |
| Don’t reveal a third party’s information when that could seriously harm them | 40 | Emails and files often contain other people’s names: they must be redacted before sending. |
An often-forgotten detail: by default, the person in charge of the protection of personal information is the person with the highest authority in the business. They can delegate the role in writing, and their title and contact details must be published on your website (s. 3.1). See our privacy policy for an example.
An AI agent to sort privacy access requests
An AI agent is an assistant that reads, sorts and prepares, based on your written rules. Its first job: recognize a request, even when it never says “Law 25.” Here’s a general inbox on a Monday morning, with fictional messages.
That sorting looks simple, but it’s where most small businesses miss the deadline. An unclear request goes unanswered, when the Act specifically asks you to help the person clarify it.
The 30 days, step by step
An access request, from day 0 to day 30
028152230
Day 0 · Received
Agent
Logged in the register, acknowledgment drafted, deadline calculated.
Day 2 · Identity
Person in charge
Identity checked before any search.
Day 8 · Search
Agent
Microsoft 365 email, CRM, accounting, shared folders: read-only.
Day 15 · File
Agent
Copy assembled, third-party information flagged, reply drafted.
Day 22 · Decision
Person in charge
Review, redaction approved, any fees announced, reply signed.
Day 30 · Deadline
Law
Past this point, the request is deemed refused. Aim for a one-week buffer.
Sample timeline for a fictional example. The agent reminds the person in charge on day 15, 22 and 27 if the file stalls.
The search is the big job. The agent goes through the sources you’ve authorized, read-only: email in Microsoft 365, the CRM, the accounting software, shared folders. It’s the same idea as an AI company-memory agent, but focused on one person and with a log of every search.
Who does what: the agent prepares, a person decides
🤖 The AI agent prepares
- ▸ Spots access and correction requests, whichever inbox they land in.
- ▸ Keeps the register and calculates the 30-day deadline.
- ▸ Searches the authorized sources for the person, read-only.
- ▸ Assembles a readable copy and, on request, a structured file (CSV, JSON).
- ▸ Highlights third-party information to redact.
- ▸ Drafts the reply with the required wording for a refusal (reason, section, recourse, deadline).
🧑💼 The person in charge decides
- ✔ Checks the requester’s identity.
- ✔ Grants, partly refuses or refuses, with reasons.
- ✔ Approves every redaction.
- ✔ Announces any fees before processing.
- ✔ Signs and sends the reply.
- ✔ Corrects the data in the systems, or confirms the correction was made.
This split isn’t just for show. An access reply can contain information about other people, a refusal must cite the right section, and a mistake can end up before the Commission d’accès à l’information. The agent saves time on preparation; judgment stays human.
Gains and limits
✅ What you gain
- No request lost in a general inbox or a form.
- A 30-day deadline tracked to the day, with reminders.
- Searches that take minutes instead of an afternoon.
- Complete, consistent replies, in French or English.
- A register ready to show if someone complains to the Commission.
⚠️ Limits to respect
- The agent has read-only access, and only to the sources you choose.
- It never decides on a refusal or a redaction.
- It sends no message without approval.
- It can miss a paper file or a document on a laptop: the person in charge confirms the search is complete.
- The AI tool must process data in an environment you control.
Getting started safely
STEP 1
Name and publish
The person in charge (by default, the person with the highest authority), with their title and contact details on your website (s. 3.1).
STEP 2
Map
List where personal information lives: Microsoft 365, CRM, payroll, accounting, paper.
STEP 3
One source at a time
Connect the agent read-only to a first source, often the email inbox.
STEP 4
Shadow mode
For the first requests, the agent prepares and a person redoes the work to compare.
STEP 5
Register and review
Every request in the register; review deadlines and errors after three months.
If you already have a virtual receptionist, it can also recognize a request made by phone and remind the person to send it in writing, as the Act provides.
Frequently asked questions
Q1. Does the agent make an “automated decision” under section 12.1?
Not if you set it up as described here. Section 12.1 covers decisions based exclusively on automated processing, which must then be disclosed and reviewed by a person on request. Since the person in charge decides each reply, the agent stays a preparation tool.
Q2. Can we charge for an access request?
Access is free. Reasonable fees can be charged for transcription, reproduction or transmission, as long as the approximate amount is announced before the request is processed (s. 33). The agent can draft that message; the person in charge approves it.
Q3. What if the person wants their data in a file?
For computerized information collected from them, the Act provides, on request, a structured, commonly used technological format, unless that raises serious practical difficulties (s. 27). The agent can produce a clean CSV or JSON file from your systems.
Q4. Does our data go to an AI vendor?
That’s the first choice to make. Favour an agent that works inside your Microsoft 365 environment or with a vendor in Canada, under a clear contract. Our article on the Crime Stoppers vendor breach shows why the contract matters.
At NeoTech, our AI and automation consulting service starts from your real data sources to define what the agent can read, what it prepares and what your person in charge approves. Nothing runs on its own without your OK.
Book a meeting to explore your AI needs
Are you getting access or correction requests, or worried you might miss them? Let’s talk about what an AI agent could prepare for you, in line with Law 25.
👉 Book a meeting to explore your AI needs
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
Photo: MART PRODUCTION, Pexels (Pexels licence).