TGV: the Privacy group (PRPS) explained

What the group covers

The Protection of personal and health information group (PRPS) checks how the vendor protects the personal information handled by its technology product or service (PST), from policies down to the screens. It has 108 criteria (P01.01 to P18.03) in 20 categories. Some only target certain PSTs, for example those serving several clients. The official grid, version of April 24, 2026, exists only in French: criteria, category names and quotes on this page are our translation, and the implementation advice and suggested evidence are Sentrix's interpretation.

The categories one by one

Privacy policy (P01.01 to P01.05)

The privacy policy and supporting documents cover the PST from design to user support. The policy is easy to consult, published in plain terms (P01.03, P01.04), and states what is collected, kept, disclosed and destroyed (P01.05). Grid reference: Art. 3.2 LPRPSP (P01.01, P01.02). The LPRPSP, Quebec's private sector privacy act, was amended by Law 25, but the grid asks its own questions, focused on the PST.

Privacy officer (P02.01 to P02.03)

If the highest authority does not take on the role, it appoints a privacy officer, with name, public contact details and job description. The officer has the resources needed (P02.02) and took part in designing the PST (P02.03). References: Art. 3.1 LPRPSP (P02.01), Art. 3.3 LPRPSP (P02.03).

Risk analysis and PIA (P03.01 to P04.02)

The project builds in privacy protection, with a stated methodology (P03.01, Art. 3.3 LPRPSP), and analyzes risks from the start (P03.02, Art. 3.3 LPRPSP et Art.63.5 LADOPPRP). P04.01 requires a mechanism to conduct a privacy impact assessment (PIA, ÉFVP in the grid) when the law calls for one. P04.02 then checks the report against 23 questions, up to its approval by senior authorities.

Awareness and training (P05.01, P05.02, P06.01)

Staff training is demonstrated: means, topics and knowledge assessment (P05.01, Art. 3.4 LPRPSP). The acquirer and users are told the authorized use of the PST and the purpose of collection, with proof they took note (P05.02, P06.01).

Consent and choice (P06.02 to P06.12)

Consent must be “manifest, free and informed” (P06.02), then collected, recorded and retrievable (P06.03, P06.05, P06.07). When the person concerned is not a user, the health professional attests they obtained it (P06.04), and likewise for disclosure to a third party (P06.12). The PST has users confirm any transfer from the DSQ (P06.06) and records acceptance of the terms of use (P06.09). P06.10 governs disclosure without consent (Access Act and Private Sector Act), and P06.11 asks for a parental consent process for minors under 14.

Third-party suppliers (P07.01, P07.02)

The organization lists its privacy requirements and its suppliers, and explains how it checks compliance. Users know the stakeholders: vendor, acquiring facility, ministry or other.

Collection limitation (P08.01 to P08.07, P08.09)

General identifiers, such as the health insurance number, require a legal provision or an agreement with the acquirer (P08.01). Direct collection for a public body follows the information requirements of the Access Act (P08.02). The PST knows the source and date of each piece of information, justifies collection on the device (cookies, location), tags DSQ data and traces flows (P08.03 to P08.07).

Access control, logging and review (P08.08, P09.01 to P09.12)

Access follows least privilege and need to know, with authentication suited to sensitivity (P09.01 to P09.03). The PST restricts access by time window, tightens control of elevated privileges and applies the restrictions people request (P09.07, P09.08, P09.10, P09.11). P09.12 allows access to be temporarily refused to the patient on a professional's advice, with reasons and duration documented. Access is logged (P09.04, P09.06) and each update keeps its origin (P09.09).

Life cycle (P10.01 to P10.10)

Each retention period is justified (P10.02) and destruction is irreversible, copies included (P10.08). P10.03 leaves the detail of security measures to the Security section. For anonymization (P10.07), the instruction cites the Gazette officielle du Québec of May 15, 2024 and a register required from January 1, 2025. The category also covers the right to be forgotten (P10.09) and disclosure rules that ease the grieving process (P10.10).

Operations and application technology (P11.01 to P11.19)

In the largest category (19 criteria), each piece of information is tied to a feature, a legal basis and a purpose, and each screen shows only what is strictly needed (P11.01 to P11.07, P11.15). Users view and correct their information, and corrections propagate to replicas (P11.11 to P11.13, P11.17). P11.18 covers hosting in Quebec. Outside cases provided by law, P11.14 bans secondary use, even of anonymized data, and P11.19 excludes personal information from learning and development of the PST.

Privacy incident management (P12.01 to P12.06)

The company defines a confidentiality incident, how it is handled, who is notified and its prevention and rapid response measures (P12.01 to P12.05). P12.06 provides for notifying the Bureau de certification and keeping an up-to-date incident register. The instructions for P12.03 to P12.06 point to the CAI's guidance.

Segregation and PI inventory (P13.01 to P14.05)

Information from several clients is segregated, as are files with distinct purposes in a data warehouse (P13.01, P13.02). The inventory covers all systems, logs included, with storage locations and sensitivity, and stays current (P14.01, P14.02). The category also asks to control transfers and to quickly identify the data involved in an incident (P14.03 to P14.05).

Policies, complaints, de-indexing and portability (P15.01 to P18.03)

P15 calls for a retention policy that is documented, followed and reviewed. Complaint handling (P16) requires trained people, a public process and a register. De-indexing (P17) requires a formal process and a protocol to explain a refusal. Portability (P18) provides for a copy in a structured, commonly used format.

Evidence to prepare

A single, well-kept inventory of personal information serves several criteria (P06.08, P08.06, P09.05, P11.14, P14.02).

• Privacy policy, supporting documents and screenshots of the public pages.
• Appointment of the privacy officer, job description and traces of their involvement.
• Risk analysis report and, where applicable, an approved PIA report.
• Training program and assessment method.
• Information, consent and attestation texts and screens.
• PI inventory: source, date, DSQ tagging, purpose, access, sensitivity, hosting.
• Matrix of profiles, functions and displayed information, with screenshots (P11.15).
• Log description, retention schedule, destruction procedure and anonymization register.
• List of suppliers and hosting providers, with their location.
• Commitment to no secondary use (P11.14).
• Incident and complaint registers, de-indexing and portability procedures.
• For P09.02, authentication for each profile, keeping in mind that the MFA orientation of December 19, 2025 requires MFA at assurance levels AU2, AU3 or AU4.

Points to watch

• Numbering does not always follow categories: P06.01, P08.08, P09.04, P09.06 and P09.09 sit in a different category from their numeric neighbours. The instruction for P06.12 refers to a “P05.04” that does not exist in this version.
• The P04.01 instruction lists 5 situations where the law requires a PIA and states “only the first one applies”: disclosing personal information outside Quebec.
• Conditional criteria: P04.02 (mandatory PIA), P06.04 (person concerned is not a user), P06.05 and P06.12 (disclosure to a third party), P06.11 (minors under 14), P13.01 (several clients) and P13.02 (data warehouse).
• P11.18 asks for hosting in Quebec, redundant components and backups included. Otherwise, the acquirer and users are clearly informed.
• P12.06 names the Bureau de certification among the recipients of a notice for an incident with a risk of serious harm.

Need help with this group?

Sentrix helps PST vendors prepare their answers and evidence for this group, without certifying the product itself. See the TGV certification support service or book a meeting.

Next in the guide

Back to the full TGV guide · TGV framework page