How can we help you?

Yes, if your organization collects, holds, uses or discloses personal information in the course of carrying on an enterprise in Québec. Obligations vary in intensity depending on the risk profile of the processing activities, but they apply to all organizations regardless of size.

No. Law 25 applies to all personal information your organization holds — your customers, but also your employees (HR files, payroll, performance reviews), your suppliers and partners (contact details, contractual agreements), and any other identifiable natural person you deal with. Many organizations focus their efforts on their CRM or analytics tools, and forget to document processing activities related to human resources, contract management or logistics. Law 25 covers all of it.

Key obligations include: designating a Data Protection Officer (DPO), maintaining a register of processing activities, conducting a Privacy impact assessment (PIA) for high-risk projects, publishing a privacy policy, managing privacy incidents with notification to the CAI, and respecting individuals' rights — access, rectification, portability and withdrawal of consent. These obligations were phased in progressively between 2022 and 2024.

No. Both elements are necessary, but they only cover your web presence. Law 25 also requires: a documented register of your processing activities, PIAs for high-risk projects, contractual agreements with your subcontractors who process personal information, the designation of a DPO, an incident management procedure with notification to the CAI, and respect for individuals' rights. The cookie banner manages consent on your site — Conformaze covers the governance of your entire organization.

Yes. These tools transmit personal information (IP addresses, browser identifiers, browsing behaviour) to third parties located outside Québec — notably in the United States. This constitutes a disclosure of personal information to a foreign subcontractor, which triggers several obligations: informing your visitors in your privacy policy, obtaining their consent before activating these trackers, and documenting this transfer in your register. Partial anonymization configuration is not sufficient to exempt your organization from these obligations.

Yes. Law 25 requires every organization to contractually govern the third parties to whom it entrusts personal information — hosting providers, SaaS software, agencies, consultants, and any other service provider with access to that data. These agreements (often called DPAs — Data Processing Agreements) must specify the purposes of processing, the expected security measures, and the conditions for data destruction. Without such agreements, your organization remains responsible for your subcontractors' failures. Conformaze centralizes the management of these contracts and their signing status.

The most useful starting point is to understand your current situation: our free maturity assessment (12 questions, a few minutes) gives you an initial reading by domain. From there, the typical approach begins with personal data mapping — identifying what flows through your organization — followed by building the register of processing activities. Conformaze guides the order of steps in its onboarding journey, tailored to your profile.

A register that complies with Law 25 does not document data fields — it documents decisions: why this information is collected, on what legal basis, who is responsible for it, how long it is retained, and what security measures protect it. These are organizational judgements that require the involvement of business, legal and technical stakeholders. Conformaze structures this collective work — it does not replace it.

A mapping tool documents what exists in your systems — data flows, applications, technical connections. It is a picture of your environment. Conformaze is used to document why this information exists, whether its processing is justified, for what purpose, on what legal basis, and for how long — decisions that belong to your organization. This is precisely the governance layer that Law 25 requires: a register of processing activities with their legal bases, their responsible parties and their retention periods.

Proving compliance means being able to demonstrate to the CAI or any stakeholder that your organization has taken reasonable and documented steps to protect personal information. This involves an up-to-date register, PIAs for at-risk projects, DPA contracts with your subcontractors, and a traceable audit trail. Conformaze structures and preserves this evidence.

No — and we refuse to make that claim. Conformaze is a documentation, tracking and evidence tool. It is your team that makes the decisions, documents the justifications and applies best practices. Compliance is an ongoing process that you build — Conformaze gives you the right tools to do it seriously.

No. Conformaze is designed to be usable by non-specialized teams, with clear guides and structures. That said, for complex projects (international transfers, high-stakes PIAs, incidents with significant impact), the advice of a specialized consultant or lawyer remains valuable. Conformaze structures your work — it does not replace expert judgement.