Law 25 compliance: where does your SMB stand?
If you keep client files, web forms, or HR records in Quebec, this applies to you. We clarify your IT controls and privacy basics, then prioritize next steps.
Updated
What Law 25 is
Law 25 is Quebec's privacy law for personal information. If you keep a client file, a web form, HR records, or digital invoices in Quebec, it applies, regardless of team size.
In practice, an SMB should be able to explain what data it collects, who can access it, how it is protected, and what happens if an incident exposes it.
This page describes an IT service. It is not legal advice.
What Atlas assesses and delivers
We review IT controls and privacy program maturity, then deliver a written report. This is not a certification.
- Technical controls: MFA, separate admin accounts, tested backups, access revoked on departure
- Privacy basics: published policy, named privacy officer, incident register, access and correction process
- Inventory of data and the tools (M365, backups, forms) that store it
- Written report with priorities: gaps that block a safe baseline first
- Implementation help for the IT actions you retain: MFA, backups, access, incident procedure
- On a monthly retainer: annual review of the basic checklist
Out of scope
We are not a law firm and we do not claim Law 25 certification.
- Legal opinions, representation before the CAI, or a lawyer's letter
- A compliance certificate or "Law 25 certified" label
- Formal penetration testing, or acting as DPO or vCISO
- Full legal drafting of policies and contracts: we flag gaps; a qualified advisor validates them
Further reading
The essentials and checklist live on Resources. This page does not repeat them.