Privacy compliance that won't stop your business.
Quebec's Law 25 applies to every business that handles personal information about Quebec residents, including yours. We help you get to defensibly compliant in 60 days, for a fixed fee.
What Law 25 actually is.
Quebec's modernized privacy law rolled out in three phases between 2022 and 2024 and is now fully in force. Enforcement is active: the Commission d'accès à l'information (CAI) can impose penalties up to $10M or 2% of worldwide turnover, rising to $25M or 4% for serious violations.
The law applies based on whose information you hold, not where you're located. If you have five employees and customers in Quebec, you're in scope.
Seven things the law requires.
Appoint a Privacy Officer
Someone must be formally responsible. If not designated, the role defaults to the highest-ranking officer. Their contact info must be public.
Publish a privacy policy
Clear, accessible, and specific about what you collect, why, how long you keep it, and with whom you share it.
Obtain valid consent
Free, informed, and specific, for each distinct purpose. Pre-checked boxes and buried terms don't count.
Run Privacy Impact Assessments
Before new systems, before transferring data outside Quebec, and before any major change to how personal information flows.
Report incidents
Notify the CAI and affected individuals when there is serious risk of harm. Maintain an incident register.
Honor individual rights
Access, correction, deletion, and portability, typically within 30 days of a request.
Written agreements with providers
Every vendor that touches personal information needs a compliant contract. That includes us. We can provide the template.
Three packages. 60 days to compliant.
We handle the technical and operational side. You partner with a lawyer for legal drafting. We can make introductions.
Readiness assessment
Data inventory, gap analysis against all seven obligations, and a prioritized remediation plan.
Implementation project
Technical controls, policy templates, PIAs for your SaaS stack, incident response playbook, and training.
Continuous compliance
Annual reviews, quarterly access audits, DSR handling, breach support, and continuous training. Bundled with any managed plan.
Where do you actually stand?
A 30-minute conversation will tell you whether you need the readiness assessment or you're closer than you think. Also take a look at our managed IT services.
Book the call →