Every Quebec business that holds personal information — clients, employees, patients — has been subject to Law 25 since 2023-2024. The vast majority of SMBs are not compliant. The good news: compliance is operated, not "projected".
You must appoint a person in charge of the protection of personal information (privacy officer) and publish their contact details. By default, it's the highest-ranking executive.
Privacy policy, rules governing collection, clear consent, and a personal information destruction procedure: all written, published and applied.
Every confidentiality incident must be recorded, assessed, and reported to the Commission d'accès à l'information if it presents a risk of serious injury.
Restricted access, logging, data protection: the law requires "reasonable" measures — and it's your ability to demonstrate them that counts.
Almost nobody delivers Law 25 as a recurring service. We do — because compliance that lasts is maintained every month, not bought once.
A full compliance scorecard: where you stand, what's missing, what's urgent. This is the Law 25 component of our $2,500 assessment.
Policies written, privacy officer appointed and equipped, incident log set up, consent and destruction processes in place.
Log kept up to date, incidents assessed and documented, ongoing support for your privacy officer, regulatory watch.
An annual compliance report delivered to management — useful for your clients, your tenders and your insurer.
The law provides for administrative and penal sanctions that can reach millions of dollars or a percentage of revenue.
Tenders, major clients and insurers now demand proof of compliance. Without it, doors close.
For an accounting firm, a clinic or a law office, a mishandled privacy incident is a crisis of trust — not a technical glitch.
Our free test gives you a first snapshot. The full $2,500 assessment gives you the compliance scorecard and the action plan.
Take the free Law 25 test See the full assessment