A SaaS vendor sends its SOC 2 Type 2 report to a Quebec client and assumes the compliance conversation is done. Then the client’s privacy officer asks for a cross-border transfer analysis under Section 17 of Law 25, plus contract clauses the vendor’s standard DPA does not have.
The core point. A SOC 2 report shows that your security controls work. Law 25 puts a separate legal duty on the Quebec client: complete a Privacy Impact Assessment before personal information leaves Quebec. Your report is supporting evidence, not that assessment.
What counts as a transfer. It is broader than storage location. Sending personal information to your API for processing counts, and so does support staff outside Quebec accessing client data for troubleshooting. A vendor with excellent data residency can still trigger the requirement.
Canadian is not the same as Quebec. Law 25 draws the line at Quebec, so a vendor hosted entirely in Ontario or British Columbia still triggers the same assessment.
What the client’s PIA needs from you:
A data flow map showing where data is stored, processed and accessed, including subprocessors.
A current subprocessor list.
Contract clauses on cross-border transfers.
The physical locations of support and operations staff.
The CLOUD Act overlay. A US-headquartered vendor with Canadian hosting can still be compelled by US authorities to produce data, which a Quebec privacy officer must weigh. A SOC 2 report does not address that jurisdictional risk.
What to do. Keep your subprocessor list current, map your data flows, prepare Section 17-aware contract language instead of a generic DPA, and remember that “Canadian” does not mean “Quebec-compliant by default.”
Read the full guide with the FAQs:
https://accorppartners.com/blogs/soc-2/soc-2-under-quebecs-law-25-what-changes-if-youre-selling-into-quebec-specifically
