Law 25 and access control logs: what property managers should know
Every time a fob opens a door, an access system writes down who, where and when. In Quebec, that record is personal information, and Law 25 shapes how you collect it, who sees it, how long you keep it and what you do when something goes wrong.
Guide · Published November 4, 2026 · Vega Access team · General information, not legal advice
Why entry logs are personal information
An entry record links a person (through their fob, code or phone) to a place and a time. Over weeks it shows when someone comes home, who visits a unit, and when a unit is empty. Quebec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25, applies to that information when it is held by a business, such as a property management company. Its obligations came into force in stages between 2022 and 2024.
1. Know why you collect it
Collect what access control needs and say why. A typical purpose statement covers: giving the right people access to the right doors, removing access when a lease or contract ends, investigating incidents such as a break-in or a dispute, and maintaining the locks. Avoid uses beyond that purpose, such as tracking when a tenant comes and goes for reasons unrelated to security. Tell owners, tenants and staff what is recorded and why, in plain language, for example in the building rules and your privacy policy.
2. Limit who can see it
The fewer people who can browse entry history, the smaller the risk. Good practice:
- Give each user their own account; never share one login across the team.
- Limit building managers and technicians to the buildings they work on.
- Reserve the audit log and full exports to the roles that need them.
- Protect sign-in with two-factor authentication and keep a login history.
In Vega Access, roles are per building, every user signs in individually with an optional second factor, and every change to access is recorded with the person who made it.
3. Keep it only as long as needed
Law 25 expects personal information to be destroyed or anonymized once the purpose for which it was collected is achieved, subject to retention periods set by law. Decide on a retention period for entry history, write it down, and apply it. In Vega Access, how far back history goes depends on your plan; choose one that matches the period you decided, not the longest one available.
4. Plan for incidents
A lost fob is not a privacy incident by itself, but a lost list of tenants and fob numbers, or unauthorized access to entry history, can be. Law 25 requires organizations to keep a register of confidentiality incidents and, when an incident presents a risk of serious injury, to notify the Commission d’accès à l’information and the people concerned. Practical steps:
- Know who in your organization is the person in charge of the protection of personal information.
- Block lost or stolen credentials immediately and keep a record of when and by whom.
- Keep exports out of email threads and shared drives that many people can open.
5. Look at your vendors, including where data goes
An access system usually involves more than one company: the software, the lock platform’s cloud, sometimes an installer. Law 25 asks organizations to assess privacy before communicating personal information outside Quebec, and to carry out a privacy impact assessment for projects to acquire or develop an information system that involves personal information. Ask every vendor where data is stored and who can access it.
For Vega Access: the management system is hosted in a Canadian data centre with encrypted daily backups. Smart locks also talk to the lock platform’s cloud, which may be outside Canada. Both facts belong in your assessment. See security and privacy.
6. Answer access and correction requests
People can ask what personal information you hold about them and ask for corrections. With an access system, that means being able to find a person’s credentials and entry records quickly, and export them. In Vega Access, every list exports to CSV, and doors and cards export to Excel.
A short checklist
- Purpose of entry logs written and shared with occupants.
- Roles defined; no shared logins; two-factor on for admins.
- Retention period decided and matched by your plan.
- Incident register in place; person in charge named.
- Vendors assessed, including data outside Quebec.
- A way to find and export one person’s records.
Where Vega Access helps, and where it does not
Vega Access provides the controls: roles per building, individual sign-in with two-factor authentication, an audit trail of every action, and exports. It does not write your privacy policy, decide your retention period or replace legal advice. For pricing and history length per plan, see plans and the calculator; for how this works in a condo, see condo access control.
Questions we hear
Does Vega Access record when people leave?
No. It records entries, with the door, the method and the time, not exits.
Can a tenant ask for their own entry records?
People can ask for the personal information you hold about them. You can find a tenant’s credentials and the related entry history in the panel and export them.
Related pages
See your buildings in Vega Access
Tell us about your doors and we’ll walk you through Vega Access on a short call — with your own buildings in mind, not a canned slideshow.
- Bring your lock models — we’ll confirm what is SMLock-based and what gateway you need.
- See the real panel — buildings, cards, tenants, remote unlock and the audit log.
- Get a tailored quote — for your doors, buildings and support level.
Prefer the phone? Call +1 (833) 330-8080.
Ready to set up? Request access to a workspace · Already a client? Sign in