A timesheet reveals a lot about an employee: their hours, their absences, their vacation and sick leave balances. In Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, governs what an organization does with it.
Updated October 9, 2026, based on Quebec's Act respecting the protection of personal information in the private sector and Civil Code as of August 12, 2026, the Regulation respecting a registration system or the keeping of a register as of June 1, 2026, and the Personal Information Protection and Electronic Documents Act as of September 21, 2026.
Does the Act apply to a non-profit?​
The Act covers personal information that a person collects, holds, uses or communicates in the course of carrying on an enterprise within the meaning of article 1525 of the Civil Code (section 1). Article 1525 defines carrying on an enterprise as an organized economic activity, whether or not it is commercial in nature, that produces goods or provides services. Profit is not part of the definition.
Within the organization, the person with the highest authority is responsible for protecting personal information, unless they delegate that role in writing (section 3.1).
What information does a timesheet contain?​
Personal information is any information about a natural person that allows them to be identified, directly or indirectly (section 2). A named timesheet contains it on every line.
Some of it is sensitive. The Act defines sensitive information as information that, in particular because of its medical nature, entails a high level of reasonable expectation of privacy (section 12). A line reading "Sick: 7 hours" on a given date already reveals more than a total of hours worked.
Collect only what serves the purposes you set (section 5). For payroll and leave banks, the number of hours of absence is enough, without the diagnosis.
What must you do before choosing timesheet software?​
Two sections of the Act apply when a Quebec organization entrusts its timesheets to a provider:
- Assess the project. Acquiring an information system that handles personal information requires a privacy impact assessment, proportionate to the sensitivity and quantity of the information. The person in charge of protecting personal information is consulted from the start (section 3.3).
- Put the contract in writing. The contract with the provider is made in writing and sets out the measures that protect the information, limit its use to the contract's purposes and prevent it from being kept after the contract ends (section 18.3).
See it with your own rules
Feuille de temps servers and database are in Canada. A privacy impact assessment was conducted on this product by a Quebec public body, with a low-risk finding.
What about outside Quebec?​
The Personal Information Protection and Electronic Documents Act (PIPEDA), the federal law, applies to information collected in the course of commercial activities. For employee information, it only covers federal works, undertakings or businesses (section 4). For the timesheets of a provincially regulated non-profit, provincial law applies: check with your province's privacy oversight body.
What should you ask the provider?​
- Where are the servers, the database and the backups?
- Who at the provider has access to the data, and how is that access protected?
- Within your organization, who sees what: employees their own timesheets, team leads their team's?
- How do you get your data back, and in what format? The Act requires the system to allow personal information to be given back to the person in a structured, commonly used technological format (section 3.3).
- What happens to the data when the contract ends?
Ask for the provider's privacy policy before the demo, and keep the answers with your privacy impact assessment.
How long should you keep timesheets?​
In Quebec, the register of hours is kept for 3 years (section 2 of the Regulation respecting a registration system or the keeping of a register). The organization's policies govern how personal information is kept and destroyed (section 3.2). The register's content is covered in How to track overtime hours for your team.
Sources​
- Act respecting the protection of personal information in the private sector, LégisQuébec
- Civil Code of Québec, LégisQuébec
- Regulation respecting a registration system or the keeping of a register, LégisQuébec
- Personal Information Protection and Electronic Documents Act, Justice Laws
Feuille de temps​
Feuille de temps is timesheet software built for non-profits, with its servers and database in Canada. Our [privacy policy](/politique-confidentialite) explains where the data and backups are, and who has access.Frequently asked questions
Does Law 25 apply to non-profits?
The Act covers anyone carrying on an enterprise within the meaning of the Civil Code, meaning an organized economic activity, whether or not it is commercial in nature. Profit is not part of that definition.
Does a timesheet contain personal information?
Yes. The hours, absences and leave balances of an identified person are personal information, and a medical reason for an absence can be sensitive information.
Is a privacy impact assessment required to choose timesheet software?
In Quebec, yes: the Act requires one for any project to acquire an information system that handles personal information (section 3.3).
Does PIPEDA protect the data of a non-profit's employees?
For employee information, the federal Act only covers federal works, undertakings or businesses (section 4). Otherwise, provincial laws apply.
Where is Feuille de temps data hosted?
Feuille de temps servers and database are in Canada.