Protect employee data during HCM migrations: PIPEDA, Quebec Law 25, data minimization, test-data masking, and privacy-by-design workflows.