Quebec Law 25

Quebec Bill 64 (Law 25) modernizing privacy - DPO, DPIA, automated decision-making, breach notification.


Short name	Law 25
Region	Americas
Country or scope	Canada
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Law 25

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for Law 25.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for Law 25 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`QC-L25-10` Security Measures Proportionate to Sensitivity	Enterprises must take security measures ensuring the protection of personal information that are reasonable given its sensitivity, purpose, quantity and medium, which for processing software includes verifiable component integrity (Private Sector Act s. 10, as amended by Law 25)	Scan
`QC-L25-3.1` Privacy Governance and Responsible Person	A person in charge of the protection of personal information must be designated and governance policies established, which is supported by clearly attributed, provenance-bearing records of the systems processing personal information (Private Sector Act s. 3.1, as amended by Law 25)	Scan
`QC-L25-3.5` Confidentiality Incident Notification Readiness	Confidentiality incidents presenting a risk of serious injury must be notified to the Commission d'acces a l'information and affected persons, requiring the ability to pinpoint which components were involved (Private Sector Act ss. 3.5-3.8, as amended by Law 25)	Scan
`QC-L25-3.3` Privacy Impact Assessment of Systems	A privacy impact assessment is required for projects to acquire, develop or overhaul information systems involving personal information, which presumes an inventory of the components those systems comprise (Private Sector Act s. 3.3, as amended by Law 25)	Scan
`QC-L25-SP` Service Provider Contracts	Communicating personal information to a service provider requires a written mandate with protection obligations, extending to visibility over the third parties supplying processing software (Law 25 service-provider/outsourcing provisions)	Scan
`QC-L25-TRANS` Transparency of Processing	Persons must be informed about the collection and processing of their information, part of a documentation posture supported by identifiable, timestamped records of the processing environment (Law 25 transparency and information duties)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`QC-3.1`	Privacy Policy & Transparency
`QC-8`	Consent Management
`QC-8.1`	Collection Purpose Specification
`QC-12`	Sensitive Information Enhanced Protections
`QC-18.1`	Cross-Border Privacy Impact Assessment
`QC-21`	Privacy Officer Designation
`QC-23`	Privacy Impact Assessment
`QC-63.5`	Confidentiality Incident Response
`QC-65.1`	Automated Decision-Making Transparency

Policy templates

Written for Law 25:

Quebec Law 25 Privacy Impact Assessment Procedure
Quebec Law 25 Automated Decision-Making Disclosure

And 22 from the standard set, adapted to Law 25.