Remote work and compliance: GDPR and Québec Law 25

Remote work moves compliance into your employees’ living rooms. Two texts structure the exercise: GDPR in Europe, Law 25 in Québec. And the remote access tool you chose for support becomes a moving part of compliance.

What GDPR requires

Under GDPR, the employer is the controller of the data its tools handle, including when the employee works from home. The vendor of the remote access tool acts as a processor: a data processing agreement is required, with precise commitments on security measures.

In practice, the employer must be able to demonstrate that it protects the data, limits exposure to what is necessary and notifies breaches within 72 hours. Fines can reach 20 million euros or 4% of annual global turnover, whichever is higher. The burden of proof sits with the employer. Demonstration beats declaration: keep records.

What Québec Law 25 requires

Law 25 modernises privacy protection in Québec’s private sector. Since September 2022, organisations must notify confidentiality incidents to the Commission d’accès à l’information and keep a register. Since September 2023, privacy impact assessments, strengthened consent rules and data portability have joined the list.

Administrative penalties can reach 25 million Canadian dollars or 4% of worldwide turnover. The law applies to organisations that hold personal information of Québec residents, wherever they are based. The reach is broad: residency of the data subject matters more than the company’s address.

What the remote access tool changes

A remote session exposes screens, files and sometimes client data, from personal machines on home networks. The tool becomes a compliance checkpoint, if you chose it for that. Screens, files, sometimes client data, all move through a channel you chose. Choosing the tool becomes an act of compliance, not just a technical purchase.

The compliance checklist

• Data residency: Ubidesk lets you choose between the European Union, Canada and the United States.
• End-to-end encryption: TLS 1.3, AES-256-GCM and ECDH, with per-session keys.
• Mandatory multi-factor authentication: TOTP, passkeys or FIDO2.
• Explicit user confirmation before any file transfer, no exceptions.
• Suspicious behaviour detection: alerts on online banking and gift cards, one-click reporting through the Trust Layer.
• Session scope: attended sessions run through a temporary client with no installation and no administrator rights, so nothing persists on personal machines.
• Certifications: ISO 27001, SOC 2 and HIPAA are in progress at Ubidesk. Check the real status rather than the logo.

Every line above is verifiable in writing; ask for each one.

The freelancer and SME case

Obligations do not scale down with size: a freelancer who takes over a client’s machine handles data, and therefore responsibility. A compliant tool covers part of the demonstration, provided you keep the proof: processing agreement, data residency, session logs.

Rules that protect everyone

On the employee side, Ubidesk remote support keeps the session visible: a 6-digit code entered by the user, a temporary client with no installation and no administrator rights, automatic blur of banking sites and password fields. The employee watches what the technician does, and nothing transfers without approval. That visibility turns the tool into evidence, for the employee and for the regulator.

On the employer side, compliance rests on a clear policy: who can open a session, on which machines, with what traceability. Add a short round of team training, and remote work stops being a grey zone. Write the policy before the first home office, not after the first incident.

Our page on remote work solutions details the rollout, from data residency to session rules. The checklist above doubles as your vendor questionnaire. And when a text leaves doubt, a lawyer settles it; the tools document it.