You appointed a privacy officer and stopped there
The appointment was the easy part. The rest — recorded consent, retention periods, the ability to find one person's data — lives in the tools, and the tools didn't change.
By situation
Law 25 doesn't ask you to buy software. It asks you to know where your data is.
No software is "Law 25 compliant" in itself: compliance belongs to the business, not the tool. What a system can do is make the obligations sustainable day to day — record consent at the moment it's given, let you find and delete a person's information, and document where data is hosted. A vendor selling you compliance itself is selling something they don't own.
What brought you here
Your data lives in seven different places
Inbox, spreadsheet, invoicing software, newsletter platform, Facebook messages, the rep's notebook. If you were asked tomorrow to delete everything you hold on one person, how long would it take?
Nobody knows where the software hosts your data
The question isn't theoretical: sending personal information outside Quebec triggers a prior assessment. Many mainstream tools host elsewhere, and that fact isn't on the pricing page.
What we actually do
Consent is recorded, not assumed
Every contact carries a record of what they consented to, when, and through which channel. It's also what separates a legitimate follow-up from spam — the same data serves both laws.
One person, one search, one complete file
Finding everything the system holds on someone must be a search, not an investigation. That capability is what makes access and deletion requests practical.
Retention periods live in the system, not in a policy
A policy that says "we keep three years" and a database holding everything since 2014 contradict each other. Rules apply automatically, or they don't apply.
Hosting is a written decision, not a default
We tell you where data resides and why, before building. Where Canadian hosting is possible and relevant, it's the default — and where it isn't, you know what that entails.
When this isn't for you
This is not a legal service and we are not lawyers: we don't draft your privacy policy and we don't rule on your compliance. If you need a legal opinion or a formal privacy impact assessment, you need legal counsel — we build the system that makes decisions enforceable once they're made.
No sales page writes this section. That's precisely why it's here: it saves you a thirty-minute call, and saves us an engagement we'd decline anyway.
Questions we get on this
Can software make me compliant?
No. It can make compliance sustainable without dedicating a full-time person to it, which is different — and that's the only honest promise. The obligations remain the company's.
Is Canadian hosting mandatory?
The law doesn't forbid hosting elsewhere: it requires a prior assessment before communicating personal information outside Quebec. Canadian hosting often simplifies the file, but it isn't a checkbox that settles everything.
We're a small business — does this really apply?
The law applies to businesses operating in Quebec, with no size threshold. What changes with size is the level of effort reasonably expected — not whether the law applies.
Neighbouring situations
Sources
Facts external to H&S are linked to their official source. Programs and laws change: check the source before deciding.
Fifteen minutes to find out whether we can be useful.
You leave with what we saw, in writing, even if we never work together.