Short answer
Sometimes, but not casually: for a Québec business, pasting a customer's personal information into a cloud chatbot usually means handing it to a service provider outside the province. Law 25 then expects a privacy impact assessment, a written agreement with protective terms and a use that matches what the customer was told, so in most everyday cases the better answer is to remove the personal details first.
Follow-up question What does Quebec's Law 25 require before you do?
When you paste a customer's email into ChatGPT or Claude, the text leaves your computer and is processed on the provider's servers. For a business in Québec, that is not just a technical detail. Under the province's private-sector privacy act, as modernized by Law 25, it is a communication of personal information (anything that identifies a person) to another organization, and very often to one outside Québec. The law does not forbid that. It sets conditions, and most of them have to be met before the first paste, not after.
So the honest answer as of October 2026 is: you can, if you have done the groundwork, and you usually don't need to. Most tasks people bring to a chatbot, such as summarizing complaints, drafting a reply or spotting trends, work just as well once names, addresses and account numbers are removed. This article explains the legal path in general terms; it is educational, so check your own situation with a privacy professional before you rely on it.
Three questions to ask before you paste
Think of it as a short decision path. Each "no" sends you back to the safer option of removing the personal details.
| Question | Why it matters | If the answer is no |
|---|---|---|
| Does this task really need information that identifies the customer? | The federal and provincial privacy commissioners recommend anonymized or de-identified information in prompts wherever possible | Replace identifiers with placeholders and continue |
| Is the use consistent with what the customer was told when you collected the information? | Section 12 limits use to the original purposes, with narrow exceptions; commercial prospecting never counts as consistent | Don't use it, or get fresh consent |
| Is the tool covered by a written agreement and an assessment? | Sections 17 and 18.3 require both when a provider handles the information for you, especially outside Québec | Use an approved tool, or de-identify |
The commissioners' joint principles on generative AI add two points worth remembering. Prompts should not be kept or reused for other purposes unless required, and anything the AI infers about an identifiable person is itself personal information. A chatbot's guess that "this customer is likely to cancel" belongs in the same category as the customer's address.
Why the provider's location matters
Most large AI services process data outside Québec. Section 17 of the act says that before personal information is communicated outside the province, the business must carry out a privacy impact assessment: a written review of the risks to the people concerned and the measures that reduce them. It must weigh how sensitive the information is, what it will be used for, the protections that will apply (including contractual ones), and the legal framework of the place where it is going. The information may go only if the assessment shows it will be adequately protected, and the transfer must be covered by a written agreement. The same rule applies when you entrust someone outside Québec with keeping or using information on your behalf.
The Commission d'accès à l'information (CAI), Québec's privacy regulator, says the same in its guidance: an assessment first, and a written agreement every time.
A worked example: forty complaint emails
A renovation company in Saint-Jérôme receives about forty complaint emails a month and wants a monthly summary of recurring problems. The owner's first idea is to paste the whole inbox into a chatbot on a personal account. Here is a better sequence:
- Define the output. The owner needs themes and counts, not names. That already tells you the identifiers are unnecessary.
- Export and strip. Copy the emails into a document and replace names, phone numbers, addresses and job numbers with labels such as
[CLIENT-07]. Do this yourself, before anything goes to the AI. - Check what is left. Delete details that could still point to a person, such as a street name in a small town or a mention of someone's illness.
- Run the analysis on the cleaned text.
- Keep the key that links
[CLIENT-07]to a real customer on your own system, so staff can follow up.
Below are 40 customer complaint emails from a renovation company. Names, addresses and job numbers have been replaced with labels like [CLIENT-07]. Group the complaints into themes, count how many emails fall under each theme, and quote one short example per theme using the labels only. Do not guess who the customers are. End with three changes the company could make to reduce the most common complaints.Try it: Take one real email you would like an AI to help with. Before pasting it, highlight every word that could identify the sender or someone they mention. If the task still makes sense without the highlighted words, remove them; if it doesn't, the task needs the formal steps below.
What does Quebec's Law 25 require before you do?
If a task genuinely needs identifiable customer information, for example drafting individual replies inside a support tool, Law 25 asks for several things before you start.
An assessment. Section 3.3 requires an assessment whenever you bring in, build or rebuild an information system that handles personal information, and adopting an AI tool for customer data fits that description. The person in charge of privacy (by default the head of the business) must be consulted from the start, and the depth of the assessment should match the sensitivity, purpose and quantity of the information. When the tool is hosted outside Québec, the section 17 assessment described above applies as well.
A written contract with the right terms. Section 18.3 lets a business share personal information without consent with a service provider when that is necessary for the service, but only if the mandate is in writing and states how the provider will protect confidentiality, use the information only for the job and not keep it afterwards. In practice this points toward business plans with a data-processing agreement rather than a personal account you signed up for with a click.
A use that matches your notice. Under section 8, when you collect information you must tell people the purposes and, where applicable, that it may be communicated outside Québec. If your privacy notice says nothing about AI tools or outside providers, update it before you change how you handle the data.
A record. Keep the assessment, the agreement and the settings you chose on file. If something goes wrong, they show that you made a considered decision rather than a convenient one.
Sources
- Act respecting the protection of personal information in the private sector (CQLR c P-39.1) — LégisQuébec, Gouvernement du Québec, September 22, 2021
- Utilisation et communication de renseignements personnels (entreprises privées) — Commission d'accès à l'information du Québec
- Principles for responsible, trustworthy and privacy-protective generative AI technologies — Office of the Privacy Commissioner of Canada, with provincial and territorial privacy authorities, December 7, 2023