Law 25 member data: the complete guide for associations

2026-11-03 — NeoAgora

Managing an association means handling valuable personal information every day: names, addresses, phone numbers, email addresses, payment preferences, activity histories. Since the phased entry into force of Bill 25 member data legislation, this information is no longer governed solely by good intentions—it entails precise legal obligations, with penalties to follow.

The good news? Compliance is not as intimidating as it seems when you break down the requirements into clear, achievable steps. This guide was designed to walk you through the process, not to scare you. You will understand exactly what the law requires, which tools to use, and how NeoAgora can support you in an approach that strengthens, above all, your members' trust in your organization.

What does Bill 25 specifically require of my association?

The Act to modernize legislative provisions as regards the protection of personal information, adopted in September 2021 and fully applicable since September 2024, has transformed Quebec's legal landscape. For an association, this translates into several direct responsibilities.

Fundamental obligations

• Appoint a person responsible for protecting personal information: this has been mandatory since September 2022. This role can be assigned to a board member or an internal coordinator.
• Publish a clear privacy policy: accessible on your website, it must explain what data you collect, why, and with whom it is shared.
• Obtain express, free, and informed consent: you can no longer assume that implicit acceptance is sufficient.
• Conduct a privacy impact assessment (PIA): particularly before any dissemination, sale, or acquisition of personal information.
• Report confidentiality incidents: in the event of a breach or unauthorized access, you must notify the Commission d'accès à l'information (CAI) as well as the affected individuals.

The link to day-to-day management

These obligations do not only concern a specialized IT department. They affect your paper membership forms, your communication emails, your accounting software, your private Facebook groups, and your Excel files containing member lists. Every point of contact where Bill 25 member data circulates is a point requiring vigilance.

What are the concrete risks of non-compliance regarding member data?

Talking about risk is not about fearmongering: it is about providing context to prioritize the right actions. The consequences of non-compliance can be severe, but they are entirely avoidable with a structured approach.

Financial penalties

Since 2024, the CAI has the power to impose administrative fines of up to $25 million or 4% of worldwide revenue. For an association with no commercial revenue, it is the fixed ceiling that applies—a considerable sum that could jeopardize the very existence of the organization.

Operational and reputational risks

Beyond the fine, consequences include:

• Loss of member trust, who hesitate to share their contact details or renew their membership;
• Suspension of government grants contingent on compliance;
• Class-action lawsuits in the event of a widespread breach;
• An unforeseen administrative burden to manage a security incident.

Fortunately, simply demonstrating an active compliance process significantly reduces the severity of penalties. It is a strong signal that you take seriously your role as guardian of Bill 25 member data.

How to obtain valid consent for collecting Bill 25 member data?

This is probably the most frequently asked question we hear during our consultations with associations. Here is how to proceed effectively.

The four criteria for valid consent

1. Express: the individual must take an active step—checking a box, signing a clause, clicking a button. Pre-checked boxes are prohibited.
2. Free: refusal must not result in the loss of service or membership. Always offer an alternative.
3. Informed: clearly explain in plain language what you will do with the data and with whom it will be shared.
4. Specific: each distinct purpose (administrative management, promotional newsletter, sharing with an event partner) requires its own consent.

A concrete example for your membership form

Rather than a generic statement like "I accept the terms and conditions," offer multiple checkboxes: "I consent to receive the monthly newsletter," "I authorize sharing my name with our event partners," "I agree to the use of my photo in the annual bulletin." This granularity reassures your members and protects you legally.

If your association uses online member portals, these dual consent features can be automated and documented, which greatly simplifies the traceability required by Bill 25.

Is my online member portal compliant with Bill 25?

A well-configured member portal can be your best ally in terms of compliance. Here are the elements you must verify.

Essential checkpoints

• Servers hosted in Canada or with a complete PIA: since September 2024, any transfer outside Canada must be assessed and documented. Prioritize Quebec or Canadian hosting.
• Data encryption: personal information must be encrypted both at rest and in transit (HTTPS protocol, AES encryption).
• Right to data portability: your members must be able to download a copy of their data (PDF or CSV export).
• Right to erasure ("right to be forgotten"): a clear mechanism must allow for the complete deletion of a profile upon request.
• Access logging: you must know who consulted which sensitive data, and when.

How NeoAgora supports this transition

When a member consults us about a compliance issue related to their digital tools, we often proceed in three stages: an audit of existing systems, a mapping of data flows, then the implementation of a suitable portal or CRM. The goal is simple: for compliance to become a natural by-product of your operations, not an additional burden.

What priority actions should be taken right now?

If you are starting from scratch, do not try to do everything at once. Here is a realistic six-month roadmap.

First quarter: diagnosis

1. Appoint your person responsible for protecting personal information and publicly display their contact details.
2. Create a data map: what types of data, held by whom, in which software, and since when?
3. Verify that your privacy policy is published and up to date.

Second quarter: corrections

1. Update all your collection forms (paper AND digital) with specific consent clauses.
2. Verify the compliance of your digital tools (website, portal, newsletter manager).
3. Implement a confidentiality incident reporting protocol.

Third quarter: consolidation

1. Train your team and your board of directors on the basics of personal information protection.
2. Document all your practices in a records of processing activities register.
3. Establish an annual policy review.

This gradual progression is exactly the approach we recommend to our clients in digital services and advisory work. It is better to move forward step by step with rigor than to try to change everything in one week.

FAQ: Frequently asked questions about Bill 25 and member data

Does Bill 25 apply to a small volunteer-run association?

Yes. The application of Bill 25 does not depend on the size of the organization, the number of members, or whether tasks are carried out by volunteers. As soon as a Quebec entity collects, uses, or communicates personal information, the obligations apply. The only nuance concerns scope: an association with 30 members will not have the same documentation as a federation of 5,000, but the fundamental principles remain the same.

Do I need to re-collect all consent signatures already obtained?

Not necessarily. The law does not require a systematic retroactive catch-up. However, if the initial consent was vague or insufficiently specific, it is recommended to seek new consent from your active members, especially for commercial uses or third-party sharing. Document each new exchange.

What to do if a member requests deletion of all their data?

You have 30 days to respond. If you have a legal obligation to retain records (for example, donation receipts for tax purposes), retain only the data required by that obligation and delete the rest. Communicate this nuance clearly to the member to maintain transparency.

Do social networks like Facebook count as collection venues?

Absolutely. If you create a private Facebook group for your members, be aware that the data exchanged passes through Meta's servers (United States). This technically constitutes a transfer outside Quebec and should ideally be documented in your PIA. For sensitive communications, prefer a locally hosted channel or a dedicated tool with Canadian hosting.

In summary: protect your members, protect your mission

Bill 25 member data legislation is not just another administrative constraint. It is an opportunity to rethink how your association honors the trust that each of its members places in it. A member who knows their data is well protected is a member who engages more sustainably.

The obligations are clear: appoint a responsible person, publish a policy, collect specific consents, secure digital tools, prepare an incident plan, and document everything. By following this roadmap, you are not merely avoiding a fine—you are building a transparent relationship of trust with your community.

Compliance is a journey, not a destination. And that journey is much easier to travel with the right tools and the right partners.