Quebec Law 25, from obligation to an operable privacy program
PIAs, confidentiality incident register, consents and access rights: CapPRP structures privacy day-to-day. CapCOM strengthens compliance and evidence.
What Law 25 requires
Law 25 imposes concrete obligations on Quebec organizations. CapGRC helps you organize, track and demonstrate them, without rebuilding the program in Excel.
Privacy Impact Assessments (PIA)
Conduct a PIA before any project involving personal information.
Privacy incident register
Document any privacy incident and notify the CAI if necessary.
Privacy policy
Publish a clear and accessible privacy policy.
Privacy officer
Designate a privacy officer and publish their contact information.
Data subject rights
Implement mechanisms to handle access, rectification and deletion requests.
Consent
Obtain free, informed and specific consent for the collection and use of personal information.
How CapGRC responds
Compliance timeline
September 2022
Officer designation, committee creation
September 2023
PIAs, incident register, new consent rules
September 2024
Right to portability, de-indexing, full enforcement
Recommended modules
CapCOM
Drive multi-framework compliance: assessments, evidence and posture, without starting over for every framework.
CapPROSEC
Build security in from design: engagements, activities, deliverables and project action plans.
CapTRISK
Industrialize vendor diligence: questionnaires, scoring, reports and follow-ups, from onboarding to reassessment.
CapPRP
The privacy module: PIAs, processing, confidentiality incidents, access rights and privacy-officer obligations.
Ready to ensure your Law 25 compliance?
Request a free consultation and discover how CapGRC can structure your compliance program.