Law 25 and EdTech vendors: a due-diligence checklist for higher education

Every new SaaS tool a college or university adopts, whether it's an LMS integration, a calendar sync, a proctoring service or a chatbot, sends student or staff personal information to a company outside the institution. Since Quebec's Law 25 came into force in stages between September 2022 and September 2024, that flow has to be assessed, contracted and documented before it starts.

The obligations bite at predictable moments: when a call for tenders is drafted, when a pilot quietly becomes production, when a contract comes up for renewal, and when an instructor signs up for a free app with a class list. This checklist is written for IT directors, procurement officers and privacy officers in cégeps and universities. It explains the law in general terms. It isn't legal advice, and the specifics for your institution should be confirmed with your privacy officer or legal counsel.

What does Law 25 require when an institution buys SaaS?

Law 25, formally the Act to modernize legislative provisions as regards the protection of personal information, amended Quebec's two main privacy acts: the one for public bodies, which generally covers cégeps and universities, and the one for private companies, which covers most vendors. For a SaaS purchase, six obligations matter most.

• A person in charge of the protection of personal information. In a public body, this role belongs by default to the person with the highest authority, who can delegate it in writing. That person, often with the institution's committee on access to information and privacy, should be involved in any project that touches personal information.
• A privacy impact assessment. Public bodies must assess the privacy impact of any project to acquire, develop or overhaul an information system or electronic service that involves personal information, starting early in the project.
• An assessment before information leaves Quebec. Before personal information is communicated outside Quebec, including when a vendor stores or processes it elsewhere, the institution must assess whether it will be adequately protected. The assessment considers the sensitivity of the information, the purpose, the safeguards and the legal framework at the destination, and the transfer must be backed by a written agreement.
• Contractual safeguards. When a service provider handles personal information on the institution's behalf, the contract must be in writing. It should spell out the measures that protect confidentiality, limit use to the contract, and ensure the vendor doesn't keep the information once the contract ends. The vendor must report any breach or attempted breach of confidentiality, and the institution must be able to verify.
• Confidentiality incident handling. The institution must take reasonable measures to reduce the risk of injury, keep a register of incidents and, when there's a risk of serious injury, promptly notify the Commission d'accès à l'information (CAI) and the people concerned.
• Retention and destruction. Personal information is kept only as long as its purpose requires, then destroyed or anonymized, in line with the institution's retention schedule.

Law 25 doesn't prescribe a logging format. But logs are how you answer the questions the law raises: who accessed this record, what changed, when, and whether an incident created a risk of serious injury. Without them, an incident assessment is guesswork.

What it costs to get it wrong

• Delays. An impact assessment started after the pilot can send the project back to the drawing board, sometimes weeks before the start of term.
• Incidents you can't assess. If a vendor can't tell you what was accessed and by whom, the institution can't judge the risk of serious injury. It may end up notifying too broadly, or too late.
• Enforcement exposure. Law 25 strengthened the CAI's oversight powers and the penalties that can follow a breach of the law.
• Trust. Students and staff expect their institution to know where their data is. A confidentiality incident at a vendor is still the institution's incident in the eyes of the public.

What doesn't work

Relying on a compliance badge. "Law 25 compliant" on a vendor's website is a marketing claim. Compliance is the institution's obligation for a specific use, and no vendor can be compliant on your behalf.

Assuming Canada means Quebec. Law 25's rule is about information leaving Quebec. Hosting in Ontario, or support staff elsewhere with access to production data, is a communication outside Quebec that needs its own assessment.

Clicking through standard terms. Online terms of service rarely include the safeguards Law 25 expects: use limited to the contract, breach reporting to your person in charge, audit rights, destruction at the end.

Doing the impact assessment after the pilot. By then, data has already flowed, and the assessment becomes a justification rather than a decision.

Ignoring free tools. A free app an instructor signs up for with a class list still involves communicating personal information. Your policy should cover it.

The due-diligence checklist

Use these questions in your call for tenders, your vendor questionnaire and your contract review. Ask for evidence, not just answers.

Before you go to market

1. List the personal information involved: student numbers, names, enrollments, grades, schedules, photos, accommodations.
2. Involve your person in charge of the protection of personal information and, where applicable, your committee on access to information and privacy, from the start.
3. Start the impact assessment while requirements are still being written, so its conclusions can shape them.

Questions for the vendor

4. Where exactly is the data hosted, including backups, logs and disaster recovery? Is any of it outside Quebec?
5. Which subcontractors (cloud host, email, support, analytics) can access the data, and where are they located?
6. Does the product keep its own copy of personal information, or does it read and write in your systems?
7. What is logged (sign-ins, data access, exports, configuration changes), for how long, and can the institution see its own logs?
8. Are logs protected against tampering, and do they avoid storing personal information in clear text?
9. How quickly will the vendor notify you of a confidentiality incident, and who will contact you?
10. How are vulnerabilities handled: fix deadlines by severity, independent penetration tests, a report you can read?
11. Is the security program certified (ISO 27001 or SOC 2, for example) or aligned with a framework? Either can be acceptable; know which one you're getting.
12. Can you export your data in a structured, commonly used format?

In the contract

13. Use of personal information limited to the services in the contract.
14. Confidentiality and security measures described, not just promised.
15. Reporting of any breach or attempted breach to your person in charge, with a deadline.
16. Your right to audit, or to receive audit evidence.
17. Destruction or return of personal information at the end of the contract, with written confirmation.
18. A written agreement covering any communication outside Quebec identified in the impact assessment.

After go-live

19. Review access rights and integration logs at least once a year.
20. Update the impact assessment when the scope changes: a new module, a new data field, a new subcontractor.

How LS2 approaches it

LS2 Innovation is a Montréal company, and its higher-education products, Teameo, Classeo and Calendo, are built to answer the questions above with documents rather than slogans.

• Quebec-resident hosting. Teameo, Classeo and Calendo run on infrastructure hosted in Quebec, and logs are replicated within Quebec.
• No second copy of student records. The products read from the SIS and write into the institution's own Microsoft 365 tenant, Moodle site or calendars. They don't keep a persistent copy of student data outside those systems.
• Audit logging on every action. Every class created, enrollment synchronized, configuration change and archive is timestamped and tagged with the user or service that performed it. Logs record technical identifiers rather than names or grades, are written append-only, and institutions can view their own integration logs in the product's administration panel. Security and audit logs are kept for 24 months; synchronization logs for 12 months, a period the institution can configure.
• Security basics. Customer data is encrypted at rest (AES-256) and in transit (TLS 1.2 minimum), and multi-factor authentication is required for any access to production.
• Incident and vulnerability commitments. LS2's published policies commit to notifying affected institutions within 72 hours of confirming an incident, coordinating with the CAI when Law 25 requires it, fixing vulnerabilities within deadlines set by severity, and an annual penetration test by an independent firm, with an executive summary available to customers on request.

The supporting documents are published in French on ls2.io: the IT security best-practices declaration, the vulnerability management policy and the event logging policy. Our English privacy policy covers the website, while each institution's use of the products is governed by its own agreements. The products are designed to meet Law 25 and the GDPR. To see where these steps fit into a deployment, read From contract to first class: a realistic SIS integration rollout plan.