Privacy impact assessment (EFVP)
A privacy impact assessment, called EFVP in French (évaluation des facteurs relatifs à la vie privée), is the impact analysis a Quebec business must carry out before certain projects involving personal information, notably before communicating it outside Quebec or acquiring an information system.
Published
In brief
- Impact analysis: compliance, risks and mitigation measures
- Mandatory before a communication outside Quebec (section 17)
- Also mandatory for an information system project (section 3.3)
- Proportionate to the sensitivity of the information, report kept up to date
The assessment comes from the Act respecting the protection of personal information in the private sector, amended by Law 25. The Commission d’accès à l’information describes it as a form of impact analysis, evolving, to be revisited throughout the project (see its April 2024 guide, in French, accessed October 14, 2026, which also offers a report template).
When is a privacy impact assessment mandatory?
- Before communicating personal information outside Quebec, or entrusting a third party outside Quebec with its collection, use or retention (section 17)
- For any project to acquire, develop or overhaul an information system or electronic service delivery system that involves personal information (section 3.3)
The scope is proportionate to the sensitivity of the information and the intended use.
What does an assessment cover for an AI voice agent?
It follows the path of a call’s information (name, number, reason, voice, transcript), assesses the risks and records the measures. With ATOM Assistant, the reasoning runs in Montreal while voice, audio and transcripts leave Canada: that transfer outside Quebec is the case section 17 targets. See the guide AI voice agents and Law 25, then the guide Do you have to tell callers they’re speaking to an AI?.
Frequently asked questions
Is a PIA mandatory for a small business adopting an AI voice agent?
It is in the situations of sections 3.3 and 17. Acquiring a system that handles calls and sending voice outside Quebec come close to them: confirm with the person responsible for the protection of personal information or an advisor.
Who carries out the assessment?
The business. It consults its person responsible for the protection of personal information from the start of the project. The provider helps by giving the processing locations, its subcontractors and the retention period.
Related
Hear your agent answer
We configure an agent for your business and you hear it take a live call.
Book a demo