Privacy law readiness
Get the technical side ready before a Law 25 or PIPEDA review.
Quebec’s Law 25 and the federal PIPEDA create real obligations around personal information: consent, incident notification, access records and demonstrable safeguards. Your privacy advisor handles the legal side. We do the technical groundwork a privacy review actually asks for. On the Managed plan, that includes the access register, the device and account inventory, and help with the incident log.
Find out where personal information actually lives
Most privacy gaps start with an incomplete picture of where data sits, not with a missing policy document. On the Managed plan, privacy support on the IT side covers the access register, the device and account inventory, and help with the incident log.
Device and account inventory
Devices, accounts, shared drives and mailboxes that store or sync personal information are listed in plain language your advisor can use.
Access register
Who can currently reach client, employee, or patient information is recorded in an access register, often the first thing a review actually asks to see.
Third-party processors
Cloud applications and vendors that receive or store personal information on the business’s behalf are listed as a tracked dependency.
Baseline technical safeguards
A review looks for demonstrable safeguards, not intentions. The Managed plan’s security baseline covers most of this ground.
Access and authentication controls
Multi-factor sign-in, least-privilege access, and account review are documented as evidence of the everyday practices already described in security essentials.
Encryption and device controls
Device encryption, secure disposal, and mobile-device safeguards are confirmed and recorded rather than assumed.
Incident log
Help keeping the incident log: what happened, when, what was affected and what was done, so the record is ready when your advisor asks.
What stays with your privacy advisor
Legal judgment stays with your privacy advisor or counsel. We supply the technical facts they work from.
Legal interpretation
Whether a specific practice satisfies Law 25 or PIPEDA, and what a privacy impact assessment must contain, is decided by your legal or privacy specialist, working from the technical facts we document.
Breach notification decisions
Whether an incident triggers a mandatory notification obligation, and to whom, is a legal decision made with qualified counsel, supported by our technical incident record.
Formal attestation
Any required certification or sign-off comes from a qualified, accountable assessor or legal advisor.
Before the first call
A useful first conversation starts with simple facts.
Bring what you already know. Nothing on this list needs a password.
Bring this to the first call
Rough answers are fine.
- Whether a privacy review or assessment already has a date
- Systems and vendors known to hold client, employee, or patient information
- Current multi-factor coverage and device-encryption status
- Whether a privacy lawyer or specialist is already engaged
- Any prior incident or access concern worth documenting now
Tell us your team size and what keeps interrupting the work.
Managed plan: $89 CAD per user, per month.Essential, at $59, covers help desk and administration only.
Tell us about your firm.
Your team size, the systems you rely on, and the first thing you want handled. A few sentences is plenty.