Answer a client's privacy request
Handle a request to see, correct or erase information without deleting records another law requires you to keep.
2 min read · Updated August 28, 2026
In short
- Verify the person's identity before sending personal information.
- Find every relevant record, not only the row in your client list.
- Answer in writing within the legal period and explain anything you must retain or refuse.
The Act respecting the protection of personal information in the private sector, as amended by Law 25, gives people rights of access and correction, and requires destruction or anonymization when information is no longer necessary. The Act also sets the conditions for portability and de-indexing.
| When received | Confirm the request and verify the person's identity. |
|---|---|
| During review | Find the records and separate what can change from what another law requires you to retain. |
| Within the legal period | Answer in writing and explain what you did, what remains and why. |
- Confirm the request and verify the person's identity using only what is reasonably needed. Do not send personal information to an unverified address.
- Find the records your business holds about that client: their client profile, notes, appointment history, messages, photos and relevant business records.
- Separate what can be provided, corrected, destroyed or anonymized from what another law requires your business to retain. Keep only the necessary part of a required record.
- Answer in writing within the legal period. State what you did, what remains, why it remains, and who the client can contact with a question.