Designed for licensees and made available for public information, some of the hyperlinks in this guideline are not publicly available.

8. Retention of personal information¹

8 .1 Secure destruction

When the purposes for which personal information was collected or used have been achieved, the licensee must destroy it, subject to a retention period provided for by law.

Thus, the OACIQ by law² specifically states that a licence holder must keep the registers and records for at least 6 years following their final closing.

The personal information collected by the licensee and contained in his registers and records is also collected for the purpose of monitoring professional practice by the OACIQ. Therefore, the registers and records containing personal information must be kept for at least six years following their final closing. This information can be in electronic format (in the cell phone [text messages, emails], in the computer, on a tablet, in the cloud) or in paper format (files, books and registers).

¹ S. 23 of the Private Sector Act, effective September 23, 2023.
² S. 17 of the Regulation respecting records, books and registers, trust accounting and inspection of brokers and agencies

▲ Return to top

8.1 Destruction sécuritaire³

For destruction compliance purposes, the licensee must take the necessary security measures to protect the confidential nature of the information contained therein.

In this regard, the agency or broker must:

Secure documents awaiting destruction
Ensure that the destruction of records and registers is entrusted only to a few specifically designated individuals and is carried out according to a clearly defined procedure and under specific conditions
Ensure that the destruction method is adapted to the medium and level of confidentiality of documents and that the content is permanently destroyed
Ensure that paper versions of documents containing personal information are never left in recycling bins without securely shredding them first