Personal Data Inventory
Map all collected, processed and stored data — who accesses it, why and where it is stored.
Governance & compliance
Turnkey Law 25 compliance
Law 25 compliance in Quebec: personal data inventory, privacy policies, incident register and team training.
The 3 pillars of Law 25
Law 25 imposes concrete obligations on all Quebec organizations that collect personal data.
Compliant Privacy Policy
Draft a clear policy in French describing your data collection practices and the rights of the individuals concerned.
Incident Register
Set up a register and notification procedure to the Commission d'accès à l'information in case of incident.
Privacy Impact Assessment
Conduct PIA for any project involving sensitive personal data or a new processing system.
Our 5-step approach
Initial Audit
Analysis of your current situation and non-compliance risks
Data Inventory
Complete mapping of all personal data processed
Policy Drafting
Privacy policy, consent forms, notices
Team Training
Awareness of your employees on obligations and best practices
Ongoing Compliance
Monitoring, annual review and adaptation to new requirements
Checklist
Your Law 25 checklist
Each point is a legal prerequisite. Our team validates and implements each one with you.
- Complete personal data inventory — All sources, purposes and retention periods
- Updated privacy policy — In French, accessible and understandable
- Documented consent — Compliant forms and consent traceability
- Incident register — Notification procedure within 72h
- Rights of data subjects — Access, rectification, erasure and portability
- Data protection officer — Designated, trained and reachable
- Employee training — Documented awareness renewed annually
- Privacy impact assessment (PIA) — For any new sensitive data processing
Who needs it?
-
Business
Quebec SMBs
Any company that collects client or employee data is subject to Law 25. Better prevent than pay up to $25M in fines.
-
Public Sector
Public Organizations
Municipalities, health centers, school boards: legal deadlines apply to the public sector too.
-
Scale-up
Growing Companies
Before a funding round or B2B partnership, compliance is often required as a prerequisite by investors.
Methodology & tools
- Questionnaires d'audit
- DPIA / EFVP
- Registre ROPA
- OneTrust
- Microsoft Purview
- ISO 27001
- Loi 25 Québec
- AIPRP
- Formation conformité
- Politique de confidentialité
- Analyse de risques
- Cartographie des données
More than an agency,
a product partner.
Product Approach
Applications that solve real problems, with a long-term vision.
Data & AI Expertise
Leveraging your data to automate, predict and optimize.
Quality & Performance
Clean code, robust architecture, built-in security.
Continuous Innovation
Generative AI, cloud, automation, user-centered UX.