Preliminary assessment · about 10 minutes

How prepared is your organization for Law 25?

This preliminary assessment helps you review the main requirements of Québec Law 25 and quickly identify practices that may require attention. Answer the ten questions based on your organization's current situation to receive an indicative result and an initial list of priorities.

After you complete the assessment and submit your contact details, a BCI team member will contact you to arrange a virtual meeting with our experts and discuss next steps suited to your organization.

1. Has a privacy officer been formally designated and are their contact details published?

2. Do your governance policies cover the full lifecycle of personal information?

3. Is every collection tied to a legitimate, specific and documented purpose?

4. Are consent requests clear, specific and separate from other information?

5. Do you maintain a confidentiality-incident register and escalation process?

6. Are retention periods and secure-destruction methods defined and applied?

7. Do you conduct privacy impact assessments for relevant technology projects?

8. Are transfers outside Québec and service providers inventoried, assessed and contractually governed?

9. Does your website privacy policy reflect the data and cookies actually used?

10. Are identification, location and profiling functions disabled by default?

Important: This questionnaire is an educational tool. Compliance depends on your actual practices, systems, contracts, suppliers, data flows and documentation.