IT consulting firm · Sherbrooke, Quebec · Engagements around the world (819) 434-6256 contact@adven.consulting
EN

Home / Cybersecurity / Law 25 assessment

Free tool

Where do you stand with Law 25?

16 questions, about 5 minutes. Get a preliminary picture of your compliance and your action priorities.

Your answers stay in your browser: nothing is stored or sent.

Preliminary assessment for information only. It is neither legal advice nor a certification of compliance.

01Person in charge of privacy

1. A person in charge of the protection of personal information has been designated (by default, the person with the highest authority, or someone delegated in writing).

2. This person's title and contact information are published on your website.

02Policies and governance

3. You have policies governing personal information (retention, destruction, roles and responsibilities, complaint handling), approved by the person in charge.

4. These policies are described in clear, simple terms on your website.

03Inventory, retention and security

5. You know what personal information you hold, where it is and who can access it.

6. Reasonable security measures protect this information (need-to-know access, multi-factor authentication, backups, encryption).

7. Information is destroyed or anonymized once the purpose for which it was collected has been achieved.

04Transparency and consent

8. A clear privacy policy is published for any collection made through technological means (website, form, app).

9. When collecting, you inform people of the purposes and obtain separate consent for each purpose (express consent for sensitive information).

10. Technological products or services offered to the public use the highest level of privacy by default, and features that can identify, locate or profile a person are turned off by default.

05Confidentiality incidents

11. You have a procedure to respond to a confidentiality incident: reduce the risk, assess the risk of serious injury and, if needed, notify the Commission d'accès à l'information and the people concerned.

12. You keep a register of all confidentiality incidents, even those without a risk of serious injury.

06Privacy impact assessments (PIA)

13. You carry out a PIA before any project to acquire, develop or overhaul an information system or electronic service delivery involving personal information.

14. You carry out a PIA before communicating personal information outside Quebec, including when it is hosted by a cloud provider outside Quebec.

07Individuals' rights

15. You can respond within 30 days to a request for access, correction or portability (information provided in a structured, commonly used technological format).

08Vendors and third parties

16. Your agreements with vendors and agents who receive personal information are in writing and include protection and confidentiality measures.

0 / 16