Lire cet article en français →
Since Episode 3 (« Your Credentials Are Sleeping in the United States »), several managers have written to us with the same question: « OK, we understand the problem. But what does compliance actually look like? » Here is the quick guide — five questions, zero jargon.
1. Where does the data live? A certification record links a name to a history: that is personal information. Quebec’s Law 25 (private-sector privacy law) makes you accountable for what happens to it, including when it crosses the border — in which case you must have assessed and documented that the protection will be adequate. A simple question to ask any vendor: « Where are your servers, and under which jurisdiction? » At Meritag: in Quebec, under Canadian jurisdiction. One-line answer, documentation provided.
2. Are you collecting the minimum? Data minimisation is a core principle: a badge needs a name, an email address, and an achievement — not a date of birth or a full employee number. Audit what your current system requires: every unnecessary field is an unnecessary risk.
3. Is consent clear? The person must understand what is being published and where. A best practice built into our platform: the badge is ISSUED, but it is the recipient who ACCEPTS it and who chooses what becomes public on their profile page. The recognition belongs to the person — that is both respectful and compliant.
4. Can you correct and delete? Rights of access, correction, and withdrawal: your recognition system must be able to fix a name, revoke an erroneous issuance, and remove visibility on request. If your vendor’s answer starts with « you would need to open a ticket with American support »… you can see where that goes.
5. Could you respond to an incident? Law 25 requires keeping a register and notifying authorities of incidents that pose a serious risk. The less your recognition data is scattered across multiple platforms, Excel exports, and emails, the more manageable that obligation becomes. Centralising everything in a system built for that purpose is incident prevention in itself.
The key takeaway
Compliance is not a tax on recognition — it is a quality standard. A well-designed badge programme is EASIER to bring into compliance than the current tangle of scattered PDF attestations: fewer copies, fewer fields, more control, and a clear answer to each question above. Data sovereignty, when you get right down to it, means exactly that: being able to answer.