A sector with distinct challenges
Law 25 applies to all Quebec organizations, but operational realities vary considerably from one sector to another. In construction, compliance presents concrete difficulties that office-based organizations do not face in the same way. Understanding these challenges is the first step toward addressing them effectively.
Data scattered across multiple job sites
An active construction company may manage several job sites simultaneously, each with its own pool of workers, subcontractors, and documents. Personal information ends up spread in many directions: timesheets, health and safety records, CCQ certifications, contact information for self-employed workers.
This dispersion makes it difficult to establish a clear inventory of the personal information held by the organization, which is a requirement under Law 25. If each foreman manages their own files, often on personal devices or in binders on site, the organization has no overall picture of what it holds or who has access to it.
Practical solution: progressively centralize information in remotely accessible systems rather than local files. This does not mean moving everything to the cloud immediately, but defining which information needs to be transmitted to the central office and within what timeframe.
High staff turnover
The construction sector is known for high turnover, particularly for seasonal workers and specialized tradespeople. Every hire involves collecting personal information; every departure creates an obligation to manage that data according to retention and destruction rules.
Law 25 requires organizations to define retention periods and destroy information when it is no longer needed for the purpose for which it was collected. With high turnover, this generates a significant volume of destruction or anonymization requests to manage.
Practical solution: establish a clear retention policy with automatic triggers. For example: information about a worker whose contract ended more than two years ago is destroyed, unless a legal obligation (CNESST, claim) justifies extended retention.
Data sharing with subcontractors
Construction job sites almost always involve multiple companies. The general contractor regularly communicates personal information to subcontractors: worker lists, site access, emergency contacts. Law 25 governs these communications.
When an organization communicates personal information to a third party, it must ensure that the third party provides an equivalent level of protection. In practice, this means including confidentiality clauses in subcontracting agreements and ensuring subcontractors understand their obligations.
Practical solution: add a standard personal information protection clause to all your subcontracting agreements. This clause should specify which information may be shared, for what purposes, and require the subcontractor to destroy it at the end of the contract.
Physical documents in site trailers
An often-overlooked aspect: physical records. In construction, many documents still exist on paper: emergency forms, certificates, attendance sheets. These documents contain personal information and are often kept in poorly secured spaces: site trailers, unlocked filing cabinets, cardboard boxes.
Law 25 makes no distinction between digital and physical formats. Personal information on paper receives the same protection as digital data.
Practical solution: identify the types of physical documents that circulate on your job sites, define where they must be kept (locked space, restricted access), and plan for secure destruction (shredding) rather than discarding documents in general waste.
Training new workers
With high turnover, privacy training must be integrated into onboarding for new workers. This is not a luxury reserved for large companies; it is a concrete way to reduce the risk of incidents caused by inattention.
The training does not need to be lengthy. A few key points are sufficient for field workers: do not photograph documents containing personal information, immediately report any lost document or unauthorized access, do not leave worker lists accessible to unauthorized individuals.
A question of organizational maturity
Law 25 compliance in construction is not an administrative formality. It reflects the quality of the organization's processes, its ability to manage information rigorously, and the respect it shows to the people whose information it holds.
Companies that take this seriously also find themselves better prepared to meet the requirements of public clients, who increasingly ask for guarantees on data management.
Observantia includes controls adapted to the realities of the construction sector, including access management by job site, subcontractor tracking, and incident documentation.
This content is provided for informational purposes only and does not constitute legal advice. For questions specific to your situation, consult a qualified legal professional.