Have you officially appointed a Privacy Officer (person in charge of the protection of personal information)?
The 16 Law 25 obligations assessed by this quiz
Law 25 imposes precise obligations regarding the protection of personal information on every Quebec business, regardless of its size. This quiz assesses your compliance on the following 16 points, grouped into 11 areas. For each unmet obligation, the Kit Loi 25 provides the corresponding template, ready to customize.
Governance
Have you officially appointed a Privacy Officer (person in charge of the protection of personal information)?
Template included in the kit: Privacy Officer appointment letter
Have you informed your employees of the Privacy Officer's identity and role?
Template included in the kit: Internal Privacy Officer announcement email
Policies
Do you have a privacy policy published on your website?
Template included in the kit: Law 25 compliant privacy policy
Do you have a documented personal information governance policy?
Template included in the kit: Personal information governance policy
Inventory
Do you keep an up-to-date inventory of the personal information you hold?
Template included in the kit: Personal information inventory register
Incidents
Do you have a documented procedure in case of a confidentiality incident?
Template included in the kit: Internal confidentiality incident procedure
Do you keep a confidentiality incident register?
Template included in the kit: Confidentiality incident register
Rights
Do you have a process to respond to access or rectification requests?
Template included in the kit: Personal information access or rectification request form
Consent
Do you have clear consent clauses on your website?
Template included in the kit: Website consent clauses
Do you use a consent form for the collection of personal information?
Template included in the kit: Personal information collection consent form
Do you have a process allowing individuals to withdraw their consent?
Template included in the kit: Consent withdrawal form
Training
Have you trained your employees on the protection of personal information and Law 25?
PIA
Do you carry out a Privacy Impact Assessment (PIA) before launching a new project involving personal information?
Vendors
Do you have contractual agreements with your vendors and subcontractors governing the protection of personal information?
Transfers
Have you assessed whether your personal information is transferred or hosted outside Quebec (e.g. cloud services, foreign vendors)?
Retention
Do you have a personal information retention and destruction policy with defined timeframes?
To understand each obligation in detail, see our free 9-step Law 25 compliance guide.