Québec compliance
Law 25: we get you there, painlessly.
Professional firms, public bodies, SMBs: Law 25 compliance shouldn't become a 6-month project. Our pragmatic approach combines assessment, Microsoft tooling and hands-on support.
Free Law 25 assessment.
A conversation with an io4 expert · your 11-point checklist reviewed · a prioritized action plan, fast.
Compliance assessment
Gap analysis against Law 25 requirements, Privacy Officer designation, mapping of personal information.
Policy, registers and rights
Privacy policy, register of processing activities, CAI-ready incident register, access, rectification and portability procedures (Sept. 2024) and the right to erasure.
Microsoft Purview & Defender
Data classification, data-loss prevention (DLP), encryption, audit and access governance. Assessment of transfers outside Québec.
Canada hosting
Configuration of data residency in the Canadian Microsoft regions (Canada Central / Canada East). Subprocessors assessed.
Automated decisions & AI
Compliance of Copilot and AI agents with Article 12.1 of Law 25: informing individuals, bias audits, Purview governance to prevent oversharing.
The 11 points to validate in 2026.
The grid we use to assess each of our Québec clients. If one of these points isn't in place, that's where we start.
- 01Designation of a Privacy Officer
- 02A compliant, accessible public privacy policy
- 03Privacy Impact Assessments (PIAs) for new projects
- 04A privacy incident register (CAI-ready)
- 05An access and rectification request procedure
- 06The right to data portability (mandatory since Sept. 2024)
- 07Mapping of data flows and assessment of transfers outside Québec
- 08Management of explicit consent and specific purposes
- 09Disclosure of automated decisions and AI use (Art. 12.1)
- 10A CAI and individual notification plan in the event of an incident
- 11Ongoing team training and awareness
Law 25 compliance is included in our io4 SOC tiers.
If you're looking for a 24/7 security program that includes documented Law 25 compliance and ready-to-sign CAI notifications, our io4 SOC tiers build it in from the Managed tier.
Frequently asked questions
Frequently asked questions about Law 25.
Can't find your answer? write to us.
Any organization operating in Québec that collects, uses or stores personal information: SMBs, nonprofits, professionals (CPAs, lawyers, notaries, physicians), municipalities, public bodies, healthcare institutions. The obligations are scaled to the size and sensitivity of the data, but no organization is exempt.
Designate a Privacy Officer, publish a compliant privacy policy, maintain a register of processing activities and incidents, carry out Privacy Impact Assessments (PIAs), assess transfers outside Québec, enable data portability (since Sept. 2024), inform individuals about automated decisions (Article 12.1), and notify the CAI in the event of an incident.
Three cumulative levels of risk: (1) Administrative monetary penalties of up to $10M or 2% of worldwide turnover, imposed by the CAI without trial. (2) Penal sanctions of up to $25M or 4% of worldwide turnover for more serious offenses. (3) Private civil remedies (Art. 93.1) since Sept. 2023: anyone harmed can now sue your organization directly, with punitive damages of at least $1,000. For a Québec SMB, a poorly handled incident can cost several hundred thousand dollars.
Article 12.1 requires any organization using a system that makes decisions based exclusively on automated processing to inform the individual concerned. Microsoft 365 Copilot and AI agents fall under this obligation as soon as they influence a decision about an employee, customer or supplier. In addition, a Copilot rollout often reveals SharePoint/Teams oversharing situations that are themselves potential Law 25 violations. That's why we always combine an oversharing audit with a Copilot deployment.
Québec's Law 25 has been in force since 2022–2024 (in phases). The federal Bill C-27 (CPPA) is still at the legislative stage and will replace PIPEDA once adopted. The European GDPR applies if you process the data of European residents. Law 25 is inspired by the GDPR but stricter on data residency and transfers outside Québec. For a Québec-based multinational, we document a unified compliance posture that satisfies all three regimes.
For an SMB: 4 to 8 weeks with our methodology. For a professional firm: 6 to 10 weeks. For a public body or a CIUSSS: 12 to 20 weeks depending on complexity and the number of systems. We always deliver: a register of processing activities, a privacy policy, sample PIAs, internal procedures, training for the Privacy Officer and teams, and an annual audit plan.
30 minutes to frame what matters.
A direct conversation with one of our experts. No commitment, no sales pitch. You leave with a clear, reasoned perspective on your situation.
