Law 25 and Privacy · 7 min · October 27, 2026
Law 25 and Privacy
Indirect identification: removing names is not enough
By Exact HR · Editorial review October 27, 2026
A job title, location or date can make someone recognizable. Learn to spot these clues in reports, surveys and training materials, then adapt what you share to the people receiving it.
How someone can be recognized without being named
Privacy depends on context. You remove an employee’s name from a report but keep their role, length of service and the date of an event. These details may seem vague to an outsider. To colleagues, they may describe only one person.
A LinkedIn profile, appointment announcement or team page may supply the missing clue. Review the document from the recipients’ perspective and consider what they could work out from the information available.
Three situations where the risk is easy to overlook
The following examples are fictional. They illustrate recommended practices to adapt to your circumstances.
An HR summary with too much detail
A message describes a supervisor in Laval who joined in the spring, manages the evening shift and is facing disciplinary action. Even without a name, the description may make the person recognizable.
A survey described as anonymous
No names are requested, but results are broken down by role, location, length of service and schedule. A comment then describes an event everyone knows about. Combining these details may make the response identifiable.
Using an external platform? Review the privacy questions to ask vendors handling personal information.
Review vendor and third-party privacy questions
A real case shared in training or on LinkedIn
Changing a first name while keeping the city, industry, role and distinctive timeline may allow someone in a professional network to recognize the individual.
Get another perspective on your communications
Unsure how much detail to include in a report or how to present survey results? Discuss your practices with Exact HR to clarify the priorities to examine in your privacy program.
For Quebec SMEs and non-profit organizations. Describe your needs to Exact HR to discuss suitable support. Avoid sending records or sensitive personal information in your initial request.
Indirect identification under Quebec Law 25
This article primarily addresses Quebec’s private-sector framework. A non-profit organization’s activities help determine whether that framework applies. Public bodies and certain health-sector information fall under other regimes.
The legal definition of personal information covers direct and indirect identification. Applying the rules therefore requires looking at what information can reveal about an individual.
De-identification and anonymization
De-identification prevents direct identification; the information remains personal information. For anonymization, it must remain reasonably foreseeable in the circumstances that the information irreversibly prevents both direct and indirect identification. These processes are not interchangeable.
The regulation governs purposes, qualified supervision, risk analysis, techniques, safeguards, reassessment and a register. Residual risks must be very low; proof of zero risk is not required. Other reasonably available information forms part of the analysis.
Five checks before sharing a document
Pre-sharing checklist
Five checks before sharing a document
Use these questions as review guideposts before sharing a report, survey or training material.
- Identify recipients. What do they already know about the people and events described?
- Look for combined clues. Review roles, dates, locations, schedules, amounts and unusual events.
- Consider cross-referencing. Check the organization’s website, LinkedIn and public announcements.
- Remove unnecessary details. Generalize a date, combine categories or summarize a comment where appropriate.
- Choose the right level of disclosure. Prepare a restricted version, a general summary or an anonymization process suited to the need.
What to do if the document has already been shared
Report the situation to your person in charge of the protection of personal information. A disclosure not authorized by law may be a confidentiality incident even when names are absent. Required reasonable measures, documentation and risk assessment must follow. Notice to the CAI and affected individuals is required promptly when there is a risk of serious injury, subject to applicable exceptions.
Structure confidentiality incident management
Structure your privacy practices with Exact HR
Exact HR supports Quebec SMEs and non-profit organizations with personal information protection. Depending on the agreed scope, work may address information inventories, access, governance, tools and staff awareness.
Explore our Law 25 support to place this need in your broader privacy program. A personal information inventory and data mapping exercise can help identify the information and access involved.
Frequently asked questions about indirect identification
What is indirect identification?
It means recognizing someone from context or a combination of clues, such as their role, work location and a distinctive event. Removing a name does not necessarily remove this risk.
Does removing names anonymize a document?
No. Other details may still make someone recognizable. Anonymization in the legal sense requires a more thorough process than removing names. See the distinctions and official sources in this article.
How does de-identification differ from anonymization?
De-identification removes the ability to identify someone directly. Anonymization also addresses indirect identification irreversibly under the legal test. De-identified information remains personal information.
Is an employee survey anonymous if it asks for no names?
Not necessarily. Detailed categories, cross-tabulated results and open-ended comments can reveal who responded. Review the questionnaire, access to responses and how results will be shared.
How many survey responses guarantee anonymity?
No number alone guarantees anonymity. Categories, cross-tabulation and context also matter. A reporting threshold can be an internal safeguard, but should be combined with other precautions.
How can Exact HR support our organization?
Exact HR supports Quebec SMEs and non-profit organizations in structuring personal information protection practices. An initial discussion helps clarify priorities, potential tools and the scope of support to consider.
Preparing a report, survey or training session? Describe your situation to Exact HR to discuss relevant support and the scope to consider. For Quebec SMEs and non-profit organizations. Avoid sending records or sensitive personal information in your initial request.
Explore related Law 25 resources
- Law 25 compliance
Place this issue in a broader personal information protection process.
- Personal information inventory and data mapping
Identify information, access, systems, flows and areas to clarify.
- Vendor and third-party privacy assessment
Review access and practices of external platforms and vendors.
- Law 25 and Vendors: Protecting Personal Information
Explore due-diligence questions when a vendor handles personal information.
- Confidentiality incident management
Structure reporting, assessment, record-keeping and follow-up when a situation occurs.
Sources and references
- LégisQuébec - Act respecting the protection of personal information in the private sector [French]
Sections 1–3, 3.5–3.8, 12 and 23.
- LégisQuébec - Regulation respecting the anonymization of personal information [French]
Sections 3–9.
- Commission d’accès à l’information - Personal information retention and destruction guidance [French]
Guideposts on retention, destruction and anonymization.