Law 25 Quebec compliance for Canadian businesses, where retention rules, incident registers and portability requests actually work.
One Canadian team finds the data, builds the register, and makes the rights answerable from real systems, so the Quebec data protection rules land in production instead of in a binder.
Where Quebec personal information actually lives, including the systems nobody wrote down: a reporting database, an old CRM export, a shared drive. The Law 25 requirements start with what you hold, not with what the asset list says you hold.
A confidentiality incident register that fills itself, plus the reporting path behind it. Section 3.8 asks for a register the regulator can call for, not a spreadsheet somebody remembers to update.
Access, rectification, portability and de-indexing, served from production rather than from promises. Portability has been a right since 2024-09-22, and most estates still can't answer one without a manual project.
Law 25 penalties run in two tiers, and the administrative one reaches $10M or 2% of worldwide turnover, whichever amount is greater.
IN PRODUCTION
A policy that says records are destroyed after seven years is a promise about what the systems do. On the estate we were handed, nobody had checked whether they could. We found personal information in four places nobody had written down, including a reporting database, then built the job that makes the policy true.
A lawyer can write your retention rules. Somebody still has to make the systems obey them.
The distance between a published policy and a working system is where the exposure sits. Law 25 penalties come in two tiers: administrative penalties up to $10M or 2% of worldwide turnover, whichever is greater, and penal offences up to $25M or 4% (source: Act respecting the protection of personal information in the private sector). The law also gives individuals a private right of action with a minimum of $1,000 in punitive damages, which is rarer than the fines and easier to trigger. A policy your systems contradict is evidence against you, not protection.
Risk sits in three predictable places. Personal information in systems nobody wrote down, usually a reporting database, an old CRM export and a shared drive. Destruction schedules that exist on paper while the data stays. And a confidentiality incident register kept as a spreadsheet somebody remembers to update, when section 3.8 asks for a register the regulator can ask to see. Quebec data protection work is mostly this: closing the gap between the written rule and the system that quietly ignores it.
Quebec's Law 25, or loi 25 in French, has been phasing in since it was tabled as Bill 64. Since 2022-09-22 you've needed a designated person responsible for protecting personal information, the privacy officer Quebec's regulator expects you to name, plus an incident register. Since 2023-09-22 most obligations apply, including governance rules you publish and explicit consent. Since 2024-09-22 portability is a right, so a person can ask for their data in a structured, commonly used format. And this Quebec privacy law reaches Canadian businesses outside Quebec: what matters is whose personal information you hold, not where your office is.
Four steps, and step 01 is the one that changes the plan. Every organisation we meet can name three or four systems holding personal information, and every discovery finds more. The reporting database nobody decommissioned. A vendor portal with names in it. Backups that outlive the destruction schedule by years. You can't write a defensible retention rule for data you don't know you have.
Discovery across applications, databases, file shares, backups and vendors, producing a map of what personal information you hold, where it sits, and which of it belongs to Quebec residents.
Retention and destruction periods per data type, the governance rules the law requires you to publish, and the designated responsible person's remit written down rather than assumed.
Deletion jobs, retention settings, export paths for portability, and de-indexing where it applies. This is engineering work, and it's the half nobody else sells.
A confidentiality incident register that populates from your own alerting, a rehearsed reporting path, and records showing a request was answered inside the statutory window.
Answers first, including whether this reaches you at all. An architect takes the call, not a salesperson.
LET'S CONNECT
A senior engineer replies within an hour, 24/7.