⚖️ Quebec Compliance
Law 25 Compliance in Quebec
Full compliance with Quebec's legislation on personal data protection. Avoid penalties, protect your clients and strengthen trust in your organization.
Compliance Dashboard
Key Requirements
The 3 pillars of Law 25
Law 25 imposes concrete obligations on all Quebec organizations that collect personal data.
Personal Data Inventory
Map all collected, processed and stored data — who accesses it, why and where it is stored.
Compliant Privacy Policy
Draft a clear policy in French describing your data collection practices and the rights of the individuals concerned.
Incident Register
Set up a register and notification procedure to the Commission d'accès à l'information in case of incident.
Privacy Impact Assessment
Conduct PIA for any project involving sensitive personal data or a new processing system.
Our Process
Our 5-step approach
1
Initial Audit
Analysis of your current situation and non-compliance risks
2
Data Inventory
Complete mapping of all personal data processed
3
Policy Drafting
Privacy policy, consent forms, notices
4
Team Training
Awareness of your employees on obligations and best practices
5
Ongoing Compliance
Monitoring, annual review and adaptation to new requirements
Checklist
Your Law 25 checklist
Each point is a legal prerequisite. Our team validates and implements each one with you.
Complete personal data inventory — All sources, purposes and retention periods
Updated privacy policy — In French, accessible and understandable
Documented consent — Compliant forms and consent traceability
Incident register — Notification procedure within 72h
Rights of data subjects — Access, rectification, erasure and portability
Data protection officer — Designated, trained and reachable
Employee training — Documented awareness renewed annually
Privacy impact assessment (PIA) — For any new sensitive data processing
Tools
Methodology & tools
Questionnaires d'audit
DPIA / EFVP
Registre ROPA
OneTrust
Microsoft Purview
ISO 27001
Loi 25 Québec
AIPRP
Formation conformité
Politique de confidentialité
Analyse de risques
Cartographie des données
Who It's For
Who needs it?
Business
Quebec SMBs
Any company that collects client or employee data is subject to Law 25. Better prevent than pay up to $25M in fines.
Public Sector
Public Organizations
Municipalities, health centers, school boards: legal deadlines apply to the public sector too.
Scale-up
Growing Companies
Before a funding round or B2B partnership, compliance is often required as a prerequisite by investors.