Practical guides, technical datasheets and white papers
In-depth resources to structure your GRC program, written by Canadian experts.
Guides and white papers
Law 25 privacy policy template
A policy to complete: purposes, retention, rights, and technologies that identify or profile.
Read guideConfidentiality incident register template
The register fields, including incidents that are not reported to the Commission, kept for at least five years.
Read guideLaw 25 subcontractor clause template
The written commitments before a supplier handles personal information.
Read guideTemplate: privacy assessment for a transfer outside Quebec
The written assessment before information leaves Quebec, including to another province.
Read guideHow to write a Law 25 privacy policy
The sections to write, the ones to remove, and where to publish the text so it matches real activities.
Read guideCommunicating personal information outside Quebec
Hosting in Ontario or in Europe is already outside Quebec. The written assessment and what the agreement has to cover.
Read guideHow to run an internal audit engagement
Mandate, evidence, finding and closure. The report closes when the recommendation has been carried out.
Read guideComplete Law 25 Guide
Everything you need to know about Quebec's Law 25: obligations, timelines and practical steps to bring your organization into compliance.
Read guideDPIA: Practical Guide
How to conduct a Privacy Impact Assessment compliant with Law 25, step by step.
Read guideManaging Multiple GRC Frameworks
Strategies to align ISO 27001, Law 25 and PCI-DSS in a unified GRC program without duplicating efforts.
Read guideRisk Assessment for SMEs
Practical method to identify, assess and treat security risks in a small or medium-sized enterprise.
Read guideTechnical datasheets
CapGRC module overviews. Choose the French or English version, then provide your details to receive the download link.
CapRISK technical datasheet
PDFProduct overview of the risk management module: register, assessments, treatments and reporting.
CapCOM technical datasheet
PDFProduct overview of the compliance module: programs, requirement assessments, evidence, gaps and audit preparation.
CapPRP technical datasheet
PDFProduct overview of the privacy module: PIAs, processing register, incidents, access requests and privacy reporting.
CapAUDIT technical datasheet
PDFProduct overview of the internal audit module: planning, evidence, findings, recommendations and closure.
CapPROSEC technical datasheet
PDFProduct overview of the project security module: register, configurable journey, gaps, deliverables, evidence and action plans.
CapTRISK technical datasheet
PDFProduct overview of the third-party risk module: vendor inventory, due-diligence questionnaires, scoring, mandates and contractual follow-up.
Downloadable templates
Provide your details to receive the file.
Law 25 privacy policy template
DOCXWord file to complete: officer, purposes, retention, rights and technologies. The form is in French.
Confidentiality incident register
XLSXExcel workbook with the register fields, including incidents that are not reported.
Law 25 subcontractor clause
DOCXWritten commitments to insert before a supplier handles personal information. The form is in French.
Transfer outside Quebec assessment
DOCXWord sheet to complete before information leaves Quebec, including to another province. The form is in French.
Law 25 DPIA Template
DOCXComplete Word template to conduct a DPIA compliant with Law 25.
Law 25 Checklist
PDFComprehensive checklist of Law 25 obligations by phase.
Risk Register Template
XLSXNIST-aligned CapGRC Excel register: scenario, inherent / projected / residual exposure.
Audit mission plan template
DOCXWord template to plan a specific multi-day audit engagement.
Annual audit program template
XLSXExcel workbook to track your company's annual internal audit program.
These templates are provided as a starting point. They must be adapted to your organization's specific context. For a turnkey compliance solution, discover the CapGRC platform.
Automate with CapGRC
Stop managing compliance in Excel files. CapGRC centralizes your risks, audits, PIAs and frameworks in a single platform.