Loi 25 Compliance & Privacy
Quebec's personal information law applies to every business, whatever its size. We build the system that makes you compliant, not just the report that says you are not.
Compliance is not a document
Most business owners meet Loi 25 through a supplier questionnaire or a client asking for a privacy policy. The natural reflex is to copy a template found online, drop it in the site footer, and call the file closed.
The assumption underneath that reflex is that compliance is a written deliverable. It is an operating practice. The law asks for a designated person in charge, a published policy that describes what you actually do, consent that is collected and traceable, an incident registry with a reporting procedure, retention and destruction rules, and a clear answer when someone asks to see or erase their information.
None of that lives in a PDF. It lives in your forms, your CRM, your inbox, your backups, and above all in what your team does the day the request arrives. A template describing practices you do not have puts you somewhere worse than silence: you have published a promise your systems cannot keep.
The starting point: the Compliance Diagnostic
A short, bounded engagement that answers one question: where do you actually stand against what the law asks. We assume nothing about your situation before looking at it.
- Information inventory: what personal data you actually hold, including the records you forgot about
- Systems map: where that data lives, who can reach it, which vendors it flows through, and what country it sits in
- Gaps ranked by exposure: what puts you most at risk first, not an alphabetical list of everything missing
- Written action plan: what to fix, in what order, at what effort. The report is yours even if you do not continue with us
What we build next
The diagnostic says what to fix. Implementation fixes it. You choose what gets built and in what order.
Privacy policy
Written from your real practices, not a generic template. In French, published where your clients will find it.
Consent management
Consent captured on your forms and newsletters, timestamped and traceable. Consent you cannot prove does not exist.
Incident registry
The registry the law requires, plus the procedure naming who does what in the hours after a privacy incident.
Retention and destruction
Written rules on how long you keep what, plus the automation that applies those rules instead of relying on someone's memory.
Access and deletion requests
A clear path to receive, process, and document requests to view, correct, or delete information within the deadlines.
Team training
A short workshop for the people who touch data daily. They are the ones who make the policy true or false.
We build the systems. We are not a law firm: for legal opinions we work alongside your counsel, or we refer you to one.
How we work
-
We meet first
No engagement gets priced before a conversation. We look at what you hold, what worries you, and what a client or supplier is asking of you.
-
We draw the flow
Your data movement becomes a flow chart, we agree on it with you, and only then do we build. You see the system before it exists.
-
We deliver in stages
A deposit opens the engagement, a payment lands at first delivery, the balance at final delivery. You pay at the pace of what you receive.
We publish no prices: compliance work varies too much between businesses for a posted number to mean anything. Every engagement receives a custom quote after the meeting. Engagements stack, and compliance sits well beside a website build or a form automation.
Questions about Loi 25
Does Loi 25 apply to a small business?
Yes. The law covers any business that collects, uses, or stores personal information in Quebec. There is no employee count or revenue threshold. A hair salon with a client list is covered the same way a manufacturer is.
Where do we start?
With the Compliance Diagnostic. We inventory what you hold, map where it lives and who can reach it, then hand you a written report with the gaps ranked by priority. You then decide whether to fix them with us or in house.
Do you give legal advice?
No. We are not a law firm. We build the systems that make your practices compliant and verifiable: policies, consent, the registry, retention automation. For legal opinions we work alongside your counsel, or we refer you to one.
How much does it cost?
It depends on what you hold and the state of your systems. We publish no figure because a posted number would be wrong in most cases. Every engagement starts with a meeting and then receives a custom quote. Some Quebec funding programs can cover part of the digitization costs tied to the project, and we check your eligibility during the call.
Start by knowing where you stand
20 minutes to look at what you hold and see whether a diagnostic makes sense for you. No commitment.