Service · Law 25 compliance
Software compliant with Law 25, from day one.
Law 25 governs the protection of personal information in Québec. Instead of bolting it on afterwards, we build your tools to respect it from the start — with data hosted in Canada and kept under your control.
- Hosting
- In Canada
- Sovereignty
- Your data, your control
- Approach
- Compliant by design
In short
Law 25 governs the protection of personal information in Québec, in force in stages from 2022 to 2024, under the supervision of the Commission d'accès à l'information (CAI). Instead of adding compliance after the fact, we build your tools to respect it by design: data hosted in Canada, minimal collection, traced access kept under your control.
What Law 25 asks, in plain words
We explain it in simple terms — this isn't legal advice, but here's what affects your tools day to day.
- Know what personal information you collect, and why.
- Get clear consent, and keep only what's needed.
- Tell people when a decision is made automatically.
- Protect the data, and be able to show who has access.
- Favour hosting and processing data in Canada.
Why custom-built helps
Hosted in Canada
Your data stays in the country, not in a foreign cloud subject to other laws.
The minimum needed
We collect only what's useful, and we don't share it behind your back.
Everything is traced
Access logs keep a record of who does what — useful when it's time to be accountable.
Under your control
You remain the owner of your data and your tool.
Frequently asked questions
When did Law 25 come into force?
It came into force in stages: September 22, 2022 (privacy officer, incident notification), September 22, 2023 (consent, transparency for automated decisions, rules on transfers outside Québec) and September 22, 2024 (the right to data portability).
What are the penalties under Law 25?
The Commission d'accès à l'information can impose administrative penalties of up to $10M or 2% of worldwide revenue. Penal fines can reach $25M or 4% of worldwide revenue — whichever is higher.
Who enforces Law 25 in Québec?
The Commission d'accès à l'information (CAI) is the body responsible for overseeing and enforcing the law.
Does data have to be hosted in Québec?
The law doesn't require hosting in Québec, but it governs the communication of personal information outside Québec (a privacy impact assessment). We favour hosting in Canada to simplify compliance and keep your data under your control.
Do you provide legal advice?
No. We explain in plain words what affects your tools and we design them to respect Law 25, but for formal legal advice, consult a legal professional.