Quebec Law 25 compliance, built into the systems and not just the policy
Trusted by
Law 25 Quebec compliance, three pillars, one operator.
One Canadian team finds the data, builds the register, and makes the rights answerable from real systems, so the Quebec data protection rules land in production instead of in a binder.
Find the data
Where Quebec personal information actually lives, including the systems nobody wrote down: a reporting database, an old CRM export, a shared drive. The Law 25 requirements start with what you hold, not with what the asset list says you hold.
The incident register
A confidentiality incident register that fills itself, plus the reporting path behind it. Section 3.8 asks for a register the regulator can call for, not a spreadsheet somebody remembers to update.
Rights that answer
Access, rectification, portability and de-indexing, served from production rather than from promises. Portability has been a right since 2024-09-22, and most estates still can't answer one without a manual project.
Does Quebec Law 25 Compliance work the same way in every industry?
No. The Quebec Law 25 Compliance work is the same craft in every sector, but the conditions around it are not. In legal that means Law Society duties and solicitor-client privilege; in financial services, OSFI's technology and cyber risk rules; and in government, Protected A, B and C data handling. We keep the service and change the part that bends.
Separate thresholds the moment you hold a Quebec client's file.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
What do you need from Quebec Law 25 Compliance?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Quebec Law 25 Compliance
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Law 25 Quebec compliance, made real.
A lawyer can write your retention rules. Somebody still has to make the systems obey them.
What Law 25 penalties actually reach.
The distance between a published policy and a working system is where the exposure sits. Law 25 penalties come in two tiers: administrative penalties up to $10M or 2% of worldwide turnover, whichever is greater, and penal offences up to $25M or 4% (source: Act respecting the protection of personal information in the private sector). The law also gives individuals a private right of action with a minimum of $1,000 in punitive damages, which is rarer than the fines and easier to trigger. A policy your systems contradict is evidence against you, not protection.
Where the risk actually sits.
Risk sits in three predictable places. Personal information in systems nobody wrote down, usually a reporting database, an old CRM export and a shared drive. Destruction schedules that exist on paper while the data stays. And a confidentiality incident register kept as a spreadsheet somebody remembers to update, when section 3.8 asks for a register the regulator can ask to see. Quebec data protection work is mostly this: closing the gap between the written rule and the system that quietly ignores it.
The dates are settled and the reach is national.
Quebec's Law 25, or loi 25 in French, has been phasing in since it was tabled as Bill 64. Since 2022-09-22 you've needed a designated person responsible for protecting personal information, the privacy officer Quebec's regulator expects you to name, plus an incident register. Since 2023-09-22 most obligations apply, including governance rules you publish and explicit consent. Since 2024-09-22 portability is a right, so a person can ask for their data in a structured, commonly used format. And this Quebec privacy law reaches Canadian businesses outside Quebec: what matters is whose personal information you hold, not where your office is.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our Loi 25 and Quebec privacy law work runs.
Four steps, and step 01 is the one that changes the plan. Every organisation we meet can name three or four systems holding personal information, and every discovery finds more. The reporting database nobody decommissioned. A vendor portal with names in it. Backups that outlive the destruction schedule by years. You can't write a defensible retention rule for data you don't know you have.
Engagement phases
Phases 01 to 04
Find it
Discovery across applications, databases, file shares, backups and vendors, producing a map of what personal information you hold, where it sits, and which of it belongs to Quebec residents.
Decide and write
Retention and destruction periods per data type, the governance rules the law requires you to publish, and the designated responsible person's remit written down rather than assumed.
Make the systems obey
Deletion jobs, retention settings, export paths for portability, and de-indexing where it applies. This is engineering work, and it's the half nobody else sells.
Prove it
A confidentiality incident register that populates from your own alerting, a rehearsed reporting path, and records showing a request was answered inside the statutory window.
Law 25 Quebec questions, answered straight.
Answers first, including whether this reaches you at all. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedCMMC ComplianceCMMC compliance for Canadian suppliers in the US defence chain, built on the controls that survived the suspension.
- RegulatedNIST Cybersecurity FrameworkNIST Cybersecurity Framework for Canadian organisations, starting with the Function CSF 2.0 put at the centre.
- RegulatedISO 27001 Certification SupportISO 27001 certification support in Canada, from the first scope decision to the audit an accredited body runs.
Not sure where you stand? Take the free Quebec Law 25 readiness assessment
