Privacy laws like Quebec’s Law 25 apply to every business that holds personal information, including employee files. Accel GRC gives you one place for the registers, assessments, policies and training the law expects.
Why it applies to most businesses
- Law 25 applies to every enterprise in Quebec, with no size threshold.
- Penalties reach $10 million or 2% of worldwide turnover.
- Clients and partners now ask how you protect the data they share.
Who will ask you for it
- The Commission d’accès à l’informationCan inspect and impose penalties.
- Clients and partnersAsk for your privacy policy, incident process and safeguards.
- Employees and customersExercise access, correction and portability rights.
- Your boardIs accountable for the program.
- 01
Map
Inventory the personal information you hold and where it goes.
- 02
Assess
Privacy impact assessments and a gap review against Law 25 and PIPEDA.
- 03
Organize
Person in charge, policies, incident register, retention rules and training in Accel GRC.
- 04
Maintain
Reminders, internal audit report and evidence ready for clients or regulators.
What you can hand to them
Click a document to see a sample. All sample documents
- Published governance policy and privacy policy
- Confidentiality-incident register
- Privacy impact assessments
- Training records and internal audit report
Delivered by
- UbitrakPCI QSA company since 2011.
- Accel PCIPCI compliance portal for merchants and service providers.
- KW ConsultingAdvisory, IT projects and remediation.
- Accel GRCGovernance, risk and compliance portal: Law 25, PCI DSS, SOC 2, ISO 27001, PIPEDA, GDPR.
Industries
Commonly bundled with
- Client security reviewsISO 27001, SOC 2 and questionnaires.
- PCI compliance onlineSelf-assessment with Accel PCI.
- Fix what the audit foundRemediation by KW Consulting.
Related insights
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how…
Read the insight →ISO/IEC 27701:2025: privacy certification no longer needs ISO 27001
The 2025 edition of ISO/IEC 27701 is a standalone privacy management system standard. Who benefits, how it maps to Quebec's Law 25, and what…
Read the insight →The EU Cyber Resilience Act: what Canadian exporters must report since 2026-09-11
Selling connected hardware or software into the EU? The Cyber Resilience Act's 24-hour vulnerability reporting duty applies since 2026-09-11, and the main obligations follow…
Read the insight →