Individual rights: what your customers can request

A customer writes: "What data do you have on me?" This is no longer a rare case. It is everyday life under Law 25. Your customers, prospects, and visitors have strengthened rights. An SMB must recognize them and respond within the required deadlines, without improvising with every email.

Main rights (overview)

• Right of access: know what personal information you hold and obtain a copy.
• Rectification: correct inaccurate or incomplete information.
• Consent withdrawal: when processing relies on consent (e.g. newsletter).
• Portability: receive certain information in a structured, commonly used format (since September 2024).
• Cessation of dissemination and de-indexing: in the cases provided for, ask to stop dissemination or search indexing (often called the "right to be forgotten").
• Complaint to the CAI: any person may contact the Commission d'accès à l'information.

Details on portability and de-indexing: portability and the right to be forgotten.

Silence is not a strategy. Not responding (or forwarding to a call centre without handling the file) is the most common trap, and often the costliest in reputation.

Organizing request intake in an SMB

Here are the steps we recommend before the first real request:

1. One dedicated email address (often the privacy officer), displayed on the site, not an "info@" inbox nobody monitors.
2. An internal template: date received, requester identity, type of right, deadline, file owner.
3. Verify identity before sending sensitive information (reasonable ID, confirmation questions).
4. Involve IT or the CRM early if the export is technical: do not promise a CSV file in 24 hours if nobody knows how to extract it.

Deadlines, pitfalls, and sample responses

The law sets strict deadlines (generally 30 days, with the possibility of a justified extension in certain cases). However, a cold acknowledgment like "We acknowledge receipt..." helps nobody. Prefer a human, clear tone:

• Access: "Thank you; we have received your request. We will get back to you with the information requested, or a clear explanation if the law allows us not to disclose everything, within the required deadline. We may need to confirm your identity before sending it."
• Rectification: confirm the correction in your systems and public sources if applicable (website, directory).
• Consent withdrawal (newsletter): effective unsubscribe within 48 business hours; keep proof (log, screenshot).

Your privacy policy must explain how to exercise these rights: same address, same deadline, no surprises for the customer.

In brief

Individual rights are not reserved for large companies. A dedicated email address, a simple register, and responses within the required deadlines are often enough to avoid a complaint and show you take privacy seriously.

Useful references

• CAI, Individual rights: official view of rights and remedies.
• Act P-39.1 (LégisQuébec): private sector text in Quebec.
• Portability and de-indexing: strengthened rights since September 2024.

This text is for information only and does not constitute legal advice. For a decision that binds your organization, consult the CAI and a legal professional.

Check your website

Rights are often exercised through the website: policy, privacy officer contact, forms. Our free technical scan helps spot observable gaps. It complements, but does not replace, your compliance program.