Law 25, without the jargon
Gap analysis, the policies and registers the law requires, and a breach procedure that works when you need it.
The challenge
Law 25 applies to nearly every Quebec business and most have done nothing beyond a cookie banner. The obligations are concrete and the penalties are not theoretical.
Scope — included and not included
Included
- Gap analysis against the law
- Privacy policy set
- Personal information inventory and register
- Consent mechanisms review
- Breach notification procedure
- Privacy officer role definition
- Privacy impact assessment method
Not included
- Acting as your designated privacy officer, available separately
- Legal opinion, we are not a law firm
- Implementing technical controls
- Ongoing operation unless retained
How it works
01
Gap analysis
Where you stand against each obligation, prioritised.
02
Build the documentation
Policies, registers, procedures — written for your reality.
03
Implement the procedures
The breach procedure and consent mechanisms put in place.
04
Train and hand over
Your team knows what to do, and who owns what.
What you receive
- →Gap analysis with prioritised actions
- →Complete privacy documentation set
- →Personal information register
- →Breach notification procedure and template
- →Privacy impact assessment method
- →Training session
What we need from you
- ·A named responsible person
- ·Access to process owners
- ·System and data flow information
- ·Roughly three hours per week
Timeline and engagement
4 to 8 weeks. Fixed scope.
Standards, methods and tooling
Law 25ISO 27701 informedPortal hosted in Canada
Frequently asked questions