Law 25 (formerly Bill 64) has imposed strict obligations since 2023 on any business that collects personal information in Quebec. A typical gym collects a lot: name, address, medical certificate, access photo, payment history. Here is what you actually need to put in place.

1. Appoint a Data Protection Officer

This is step #1, and the most forgotten one. The owner or a designated executive must be identified as the responsible party. Their contact information must be published on your website and accessible to any member who requests it.

2. Keep an Incident Log

Any confidentiality incident (theft of a laptop, email sent to the wrong recipient, system intrusion) must be logged. If the incident poses a serious risk, you have an obligation to notify the Commission d'accès à l'information AND the individuals concerned.

3. Obtain Clear Consent

Consent to collection must be: - Manifest (checkbox not pre-checked) - Free and enlightened (why you are collecting what) - Specific for each purpose - Granular (the member can opt-out of marketing while still accepting contract management)

4. Allow the Exercise of Rights

Any member may demand: - Access to their data - Rectification - Deletion (under certain conditions) - Portability (export in a reusable format) - Withdrawal of consent

You must respond within 30 days.

5. Manage Transfers Outside Quebec

If your data is hosted abroad or if a subcontractor is located outside Quebec (a US CRM, for example), you must: - Perform a privacy impact assessment - Document protective measures - Inform members

6. Keep Only for as Long as Necessary

Once the purpose is achieved, the data must be destroyed or anonymized. Typical retention for a gym: - Active contracts: for the duration + 3 years (tax purposes) - Inactive members for +3 years: to be anonymized - Video surveillance: 30 to 90 days depending on the purpose

7. Sanctions: What You Risk

Fines can reach: - $25 million or 4% of global turnover for organizations - $100,000 for administrators/directors

Even a small gym can be targeted by a member complaint. Compliance is no longer optional.

SGS by TrainIQ is designed to facilitate your Law 25 compliance: Canadian hosting, automated exports and deletions, access log, consent registry. You retain the responsibility, we provide the tools.