Québec: Private-Sector Privacy Act Automated Decision Rules (CQLR c P-39.1, s 12.1)

QuébecLegislationApplicable

Section 12.1 of Québec's Act respecting the protection of personal information in the private sector (CQLR c P-39.1) establishes statutory requirements for enterprises that use personal information to render decisions based exclusively on automated processing. Organizations must inform individuals no later than when the decision is communicated. Upon request, the enterprise must disclose the personal information used, explain the principal factors and parameters driving the outcome, and advise individuals of their right to rectify inaccurate data. The law further requires enterprises to provide affected individuals an opportunity to submit observations to a representative capable of reviewing the determination. The statute does not prohibit automated processing, nor does it govern AI-assisted workflows where meaningful human judgment actively shapes the final outcome.

Impact

What this means for HR and vendors

HR and recruitment teams

Employers and recruitment teams utilizing automated filtering or rejection systems must establish proactive notification protocols and human-review pathways. If an applicant tracking system rejects a candidate automatically without human intervention, the organization must notify the applicant at the time of communication. Employers must be equipped to explain the underlying parameters upon request and route candidate observations to personnel authorized to reconsider outcomes. Organizations should also ensure personal information used in employment decisions is retained for at least one year under Section 11.

HR technology vendors

HR technology providers and recruitment software vendors face substantial commercial and compliance expectations from enterprise deployers. Because employers remain legally liable for decisions made through automated software, deployers require providers to supply explainability documentation, feature weighting details, and clear parameter descriptions. Providers of automated screening or ranking tools must build features enabling deployers to export input data, log automated decision rationale, and facilitate downstream human re-evaluation workflows.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerTransparency & Notice

Notice of Profiling and Identification Technology

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

Notice of Exclusively Automated Decision-Making

Explanation of Automated Decision Factors and Parameters

Right to Submit Observations and Human Review

One-Year Minimum Retention of Decision Data

Privacy Impact Assessment for Information Systems

Notice of Profiling and Identification Technology

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences