Law 25 is fully in force. Your compliance program needs to be too.
Law 25—Quebec’s Act Respecting the Protection of Personal Information in the Private Sector—has been in full force since September 2023. The CAI has issued its first enforcement actions. US-built GRC platforms treat Law 25 as an afterthought. Sentrix was built in Montréal with Law 25 as a first-class citizen—bilingual, Canadian data residency, and native CAI reporting workflows.
PIA. Breach notification. Portability. Consent. Governance. All of it. Now.
Law 25 introduced some of the most stringent privacy obligations in Canada. Organizations must conduct Privacy Impact Assessments before collecting personal information, appoint a person responsible for personal information protection, notify the CAI within 72 hours of a confidentiality incident, and respond to data subject requests for access and rectification within 30 days. Sentrix automates the technical controls behind each obligation.
- Art. 3.1: Appointment of a responsible person for personal information protection
- Art. 8: Right of access to personal information with 30-day response SLA
- Art. 12.1: Privacy by default—collection limited to what is necessary
- Art. 63: PIA required before any project involving personal information
- Art. 63.3: Confidentiality incident notification to CAI within 72 hours
- Art. 28.1: Data portability rights for information collected by automated means
Loi 25 · Obligation compliance
CONTINUOUS MONITORINGEvery Law 25 obligation. Automated. Bilingual. Canadian.
Privacy Impact Assessment (PIA)
Law 25 Art. 63 requires a PIA before any project involving personal information. Sentrix provides bilingual PIA templates, tracks completion, stores assessments as audit evidence, and alerts when new projects trigger PIA requirements.
Confidentiality incident response
72-hour CAI notification workflow, affected person notification letter templates in FR/EN, incident register maintained automatically, and all documentation stored as audit evidence in the format the CAI expects.
Data subject request management
Access, rectification, and portability requests tracked with 30-day response SLAs. Request log maintained as evidence. Automated reminders before deadlines. Response documentation archived.
Privacy by default controls
Art. 12.1 requires data minimization by default. Sentrix monitors your data collection practices, flags integrations that collect unnecessary personal information, and documents your privacy-by-default settings.
Bilingual documentation
All PIAs, policies, breach notifications, and audit packages available in French and English. Required for Québec organizations and public sector bodies governed by Law 25.
GDPR crosswalk
Organizations with EU customers managing both GDPR and Law 25 run both from one Sentrix program. The significant overlap (consent, DPIA/PIA, breach notification, data subject rights) is mapped automatically.
See your Law 25 compliance posture in real time.
30-minute demo in French or English. We use your real infrastructure.
Law 25 (Loi 25) Quebec Privacy Compliance Automation
Quebec's Act respecting the protection of personal information in the private sector, commonly known as Law 25 or Loi 25, introduced the most significant overhaul of provincial privacy legislation in Canada in decades. Sentrix delivers purpose-built compliance automation for Quebec organizations navigating the full scope of Law 25 obligations — from Records of Processing Activities and Privacy Impact Assessments to consent management, data subject rights fulfillment, and mandatory breach notification to the Commission d'accès à l'information (CAI).
Built Specifically for Quebec Organizations
Unlike generic compliance platforms adapted from European GDPR toolkits, Sentrix was designed with Quebec's regulatory environment at the centre. Law 25 phases in obligations across a multi-year timeline and imposes requirements that differ meaningfully from federal PIPEDA obligations. Sentrix maps every control to the specific articles of Law 25 while maintaining a PIPEDA crosswalk so organizations subject to both regimes can manage unified compliance without duplicating effort across disconnected systems.
Records of Processing Activities (ROPA)
Law 25 requires organizations to maintain a detailed register of personal information holdings and processing activities. Sentrix automates the creation and ongoing maintenance of your Records of Processing Activities by discovering data assets across business systems, assigning ownership, and tracking lawful basis for each processing purpose. The ROPA register is continuously updated as your data landscape changes, giving your Privacy Officer a reliable, audit-ready inventory at all times rather than a static document that grows stale between annual reviews.
Privacy Impact Assessment and EFVP Automation
Law 25 mandates a Privacy Impact Assessment — known in French as an Évaluation des facteurs relatifs à la vie privée, or EFVP — before launching any new project involving personal information or before communicating personal information outside Quebec. Sentrix provides structured EFVP templates that align directly with CAI guidance. Automated workflows route assessments to the appropriate reviewers, capture sign-off, track remediation of identified risks, and retain a complete record of each assessment for regulatory inspection. Organizations processing high volumes of new initiatives benefit from Sentrix's ability to run parallel assessments without administrative bottlenecks.
Consent Management and Data Subject Rights
Law 25 establishes explicit requirements around the collection, use, and withdrawal of consent for personal information. Sentrix provides a centralized consent management layer that records consent events, links them to the applicable processing purpose, and triggers automated workflows when individuals exercise their rights. Quebec residents have the right to access their personal information, request corrections, withdraw consent, and in certain circumstances request data portability and the cessation of dissemination. Sentrix routes incoming data subject requests to the correct teams, enforces statutory response timelines, and generates the documentation required to demonstrate compliance to the CAI.
72-Hour Breach Notification to the CAI
Law 25 requires organizations to notify the CAI within 72 hours of discovering a confidentiality incident that presents a risk of serious injury. Sentrix automates the breach notification workflow from initial incident detection through risk assessment, regulatory notification drafting, and affected-individual communication. Built-in severity scoring evaluates each incident against the criteria specified under Law 25, ensuring your team can make fast, defensible decisions about notification obligations without relying on manual triage under pressure.
PIPEDA Crosswalk for Cross-Jurisdictional Compliance
Many Quebec private-sector organizations are subject to both Law 25 and the federal Personal Information Protection and Electronic Documents Act. Sentrix maintains a living crosswalk between Law 25 articles and PIPEDA fair information principles, enabling compliance teams to satisfy both regimes from a single control framework. As the federal government advances Bill C-27 and the proposed Consumer Privacy Protection Act, Sentrix continuously updates its framework mappings to keep Quebec organizations prepared for the evolving national privacy landscape.
Demonstrate Accountability to the CAI
The CAI has broad powers to investigate, audit, and sanction organizations that fail to meet Law 25 obligations. Sentrix provides the evidence repository, audit trails, and reporting dashboards that Privacy Officers need to demonstrate accountability on demand. Quebec organizations working with Sentrix gain a continuously maintained compliance posture rather than a point-in-time snapshot, reducing the risk of regulatory findings and administrative penalties.