This Act assigns the Ministère de la Cybersécurité et du Numérique (the Minister) centralized responsibility for a provincial “national digital identity,” establishes a national digital identity register under ministerial control, and makes the Minister the official source of certain government digital data. It also expands the Minister’s remit over telecommunications infrastructure and allows the Ministry to develop and operate non‑commercial connectivity networks and to offer cloud and “specialized technology” services to public bodies.
Operational changes in the bill include mandatory use by public bodies of ministerial identity and some information‑resource services (subject to Government exemptions), a new duty to notify the Minister of serious information breaches, transfer of certain data‑sharing authorities (health and tax data provisions), and regulatory powers over biometric data and authentication standards. For compliance officers and IT leaders, the law centralizes procurement and data flows, shifts certification authority to the Minister, and creates new integration and privacy questions to resolve during implementation.
At a Glance
What It Does
The bill makes the Minister the centralized manager and official source of a provincial national digital identity, creates a national digital identity register with defined functions, and requires public bodies to use ministerial identity services except where the Government exempts them. It also gives the Minister powers to set a government‑wide telecom vision and to build and operate non‑commercial connectivity infrastructure.
Who It Affects
Quebec public bodies and their CIOs, the Ministère de la Cybersécurité et du Numérique, certification service providers, entities that operate essential systems or infrastructures, and citizens who interact with government e‑services (and whose data may be centralized). Amendments to health and tax statutes specifically enable the sharing of personal identity attributes with the Minister.
Why It Matters
This is a provincial pivot from dispersed identity and IT governance toward a single ministerial authority that will control identity services, certain data sources, and telecom coordination. That changes where compliance responsibility sits, who signs contracts for identity and telecom services, and how privacy and interoperability requirements will be implemented and enforced.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act defines a “national digital identity” as the set of tools the State offers so people can securely access government electronic services and hold government‑issued digital attestations they control. The law explicitly says public bodies cannot force a person to use that identity to get services, preserving choice at the front end even as back‑end systems become centralized.
Practically, the Minister now manages governance and centralized operations for that identity across the public administration. That includes setting a governance framework for the personal information needed to identify and authenticate people, establishing processes to verify data coherence and quality, and acting by office as an official source of government digital data.
The Act lists sample data types (name, date and place of birth, parents’ names, legal person contact data) and gives the Government power to add other categories by regulation.The law builds a ministerial national digital identity register intended to store, share and provide traceable access to government digital data; the register must record every access and cannot be used for profiling. The Minister can also prescribe rules on identification and authentication, and the Government can set targets for public bodies (for example, uptake rates or interoperability terms) and require joint agreements between the Minister and a public body for cross‑system connections.On the telecom side, the Minister must develop and submit a government‑wide vision for telecommunications infrastructure and coordinate public‑sector actions to optimize and mutualize networks.
The Minister may, for non‑commercial purposes, acquire, lease or dispose of property to develop or operate connectivity infrastructure (fibre, towers, satellites, antennas), and may authorize access to immovables to conduct inventories and preparatory work, subject to compensation for damages.The bill also tightens cybersecurity governance: public bodies without an internal security unit must use Ministerial services for cybersecurity if offered; any public body (and potentially other designated owners/operators of essential systems) must promptly notify the Minister of a breach that presents a risk of serious injury; and the chief information officer may delegate or subdelegate functions. The Act moves certification of certification service providers to the Minister and makes targeted amendments to the Tax Administration Act and Health Insurance Act to permit specified data transfers to the Minister for identity purposes.
Transitional clauses validate prior orders and registers as the new national framework comes into force.
The Five Things You Need to Know
Section 10.3 bars public bodies from making the use of the national digital identity mandatory for individuals seeking government services.
Section 10.5 requires public bodies to use the national digital identity services the Minister determines are in the Ministry’s offering, unless the Government exempts them.
Section 10.6 makes the Minister the official source of government digital data for identity purposes and explicitly lists data types (name, date/place of birth, parents’ names, legal‑entity contact data), while allowing the Government to add categories.
Section 10.7 creates a national digital identity register that must secure, enable communication of and log every access to stored government digital data, and it forbids using the register data for profiling.
Section 12.5.3 imposes a prompt breach‑notification duty on public bodies (and potentially other designated operators) when an information asset breach presents a risk of serious injury, with the Minister authorized to set the criteria by regulation.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Telecommunications vision and non‑commercial connectivity powers
These sections require the Minister to develop a government‑wide vision for telecommunications infrastructure and to coordinate public bodies’ actions to mutualize and optimize networks. They also authorize the Minister to acquire, rent or dispose of property and to operate a non‑commercial connectivity network; the Minister (or designate) may access immovables for inventories and preparatory work, provided reparations for damage are paid. Practically, these provisions centralize strategic planning for telecom assets and give the Ministry tools to build physical infrastructure where it judges necessary for state operations.
Minister can offer cloud and ‘specialized technology’ services
The Act expands the Minister’s service catalogue beyond cloud offerings to include ‘specialized technology’ — defined to include integrated management software, cybersecurity, foundational technology infrastructures and legacy mainframe platforms. That change broadens the Ministry’s role as a supplier to public bodies and shifts where procurement and operating decisions for key platforms will be made, with implications for vendor engagement, contracting rules and standards adoption.
Definition, governance and operational architecture of the national digital identity
This new chapter defines the national digital identity, mandates ministerial governance and centralized management, and sets out the Minister’s obligation to provide identity services and to act as an official source of government digital data. It establishes the identity register, enumerates core data categories, prohibits profiling of register data, and gives the Minister and Government regulatory authority over data quality standards, biometric uses and authentication rules. The chapter balances central control with a formal prohibition on imposing identity use on individuals, while giving the Minister the power to require public bodies to adopt ministerial services.
Operational governance: CIO delegation, cybersecurity services and breach notifications
The amendments let the chief information officer delegate and subdelegate statutory functions, require public bodies without a security unit to call on Ministerial cybersecurity services, and create a duty to notify the Minister of breaches that pose a risk of serious injury. The Minister can regulate the criteria that define ‘risk of serious injury.’ These mechanics shift incident reporting and certain security‑service responsibilities toward the Ministry and create new compliance checkpoints for public bodies’ information governance.
Official sources and mandatory sourcing of reference data
The Act tightens the rule that an official source of government digital data must ensure coherence and quality and requires public bodies to collect and use such data from the designated source, or to communicate them back to it; the Government may exempt public bodies or categories from that duty. This imposes stronger central control over reference data flows and establishes the Minister’s register as the primary repository for core identity attributes.
Targeted data access for identity purposes
The Health Insurance Act now requires the Board to transmit specific identity attributes (name, DOB, sex, contact info, spouse) to the Minister when necessary for national identity functions; parallel amendments in the Tax Administration Act permit communications to the Minister for those identity purposes. Those edits operationalize the Minister’s access to authoritative identity attributes and reduce friction in assembling identity profiles across government registers.
Validation of prior orders and registers; phased implementation
Transitional clauses validate existing orders and the government identity attributes register as the new national digital identity register and deem certain prior rules made under earlier authority to have been made under the new statutory powers. The Act defers entry into force for specified paragraphs until the Government sets dates or the first relevant regulation is published, creating an implementation window to phase systems, rules and obligations into effect.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Citizens who opt in to the system — they may get simpler, more secure access to multiple public services through a single, government‑backed identity and government digital attestations that they control, reducing repeated identity checks.
- Public bodies with limited IT security or identity expertise — the requirement (or availability) to use Ministerial identity and cybersecurity services provides a centralized option to obtain vetted infrastructure and incident response support.
- Ministère de la Cybersécurité et du Numérique — the Ministry gains strategic control over identity, core government data sources and telecommunications planning, consolidating authority and creating new operational and contracting responsibilities.
- Service providers and integrators of specialized technology — expanded ministerial offerings open procurement opportunities for integrated management software, cybersecurity platforms, legacy modernization and cloud/specialized tech contracts.
- Rural or underserved communities — Minister‑operated, non‑commercial connectivity projects could improve public connectivity where commercial operators do not invest, facilitating access to e‑services.
Who Bears the Cost
- Public bodies — they must realign systems to draw authoritative identity attributes from the Minister’s sources, adopt ministerial services when designated, change procurement practices and comply with new breach‑notification rules.
- The Ministère de la Cybersécurité et du Numérique — the Ministry inherits heavy operational obligations (running a register, offering services, operating networks) and will need sustained funding, staffing and liability management to meet service expectations.
- Privacy advocates and individuals — centralization of identity data and expanded ministerial access increase the risk surface for misuse, function creep or large‑scale incidents, placing privacy protection and oversight burdens on civil society and regulators.
- Certification service providers and existing suppliers — shifting certification authority and central procurement may alter market positioning, require re‑certification under ministerial criteria, and disrupt incumbent contracts.
- Owners/operators of essential systems or infrastructures — the Government may extend breach‑notification obligations to them, increasing compliance costs and reporting obligations for private and quasi‑public operators designated as essential.
Key Issues
The Core Tension
The central dilemma is between the administrative efficiencies and stronger, government‑wide identity assurance that come from centralizing identity and telecom functions under one ministry, and the privacy, resilience and governance risks that follow from concentrating sensitive identity data, regulatory discretion and operational responsibilities in a single provincial actor.
The Act creates strong centralized tools for identity and telecom governance but leaves many crucial details to regulation or Government orders. Key implementation questions include how the Minister will define “government digital data” beyond the enumerated items, what technical and privacy standards will apply to biometric data if authorized, and how the Ministry will operationalize data‑quality assurance across legacy systems.
Those regulatory choices will determine whether centralization produces interoperable, privacy‑protective services or a brittle monolith that increases systemic risk.
Operationally, the Ministry must reconcile ambitious infrastructure powers (access to immovables, network construction) with municipal land‑use rules, federal telecommunication regulations, procurement constraints and funding realities. The breach‑notification standard hinges on a regulatorily defined “risk of serious injury,” a phrase that will shape reporting volumes and the Minister’s resource needs for triage and response.
Finally, moving certification authority and expanding ministerial service offerings concentrates market power, which may speed standardization but could narrow supplier diversity and complicate legacy‑system transitions for public bodies.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.