Where do you stand with Law 25?

1. Have you appointed a person in charge of personal information protection and published their contact details?

2. Do you have personal-information governance policies, published on your website?

3. Do you have an inventory of your information assets with a sensitivity rating (availability, integrity, confidentiality, traceability)?

4. Do you keep an up-to-date register of your personal-information processing activities (purposes, categories, recipients, retention)?

5. Do you have defined retention periods and a destruction or anonymisation process at end of lifecycle?

6. Do you inform individuals, at collection, of the purposes, their rights and third-party recipients?

7. Do you have a process to answer access and rectification requests within the 30-day deadline?

8. Do you perform a privacy impact assessment (PIA) for risky projects or communications outside Québec?

9. Do you have a confidentiality incident register and a procedure to notify the CAI?

10. Do you frame communications of personal information to third parties or outside Québec (agreements, assessment)?