Law 25 compliance, under control.
Law 25 applies to every Quebec business that handles personal information. Observantia gives you the structure, the tools, and the audit trail to manage compliance without a legal team or a $30K consulting project.
Law 25 is mandatory. Most organizations don't know where to start.
Quebec's privacy law requires every organization to protect personal information, respond to access requests within 30 days, report breaches, and conduct impact assessments before new projects. The obligations are real, the deadlines are tight, and the penalties are significant.
- No dedicated legal team to interpret the requirements
- Scattered spreadsheets and documents with no central tracking
- No way to prove compliance when an auditor asks
A command center for Law 25 compliance
Structured tools for each obligation in the law. Not a checklist; a system that tracks your work, meets your deadlines, and builds the evidence trail you need.
Compliance Assessments
Work through 100+ controls grouped by topic. Each one is rated Required, Recommended, or Optional. Mark your status, get a compliance score, and see exactly where the gaps are.
Incident Registry
When a breach happens, log it here. The tool assesses whether it poses a risk of serious injury and walks you through the legally required notification to the CAI.
Access Requests (DSR)
Someone asks for their data or wants it deleted? You have 30 days. Observantia tracks each request, calculates the deadline, and sends email reminders at 15 and 25 days.
Privacy Impact Assessments
Before launching any project that involves personal data, Law 25 requires a risk assessment. A guided 9-step form covers data flows, third parties, cross-border transfers, and mitigations.
Template Library
13 bilingual document templates: privacy policy, governance policy, incident response plan, consent forms, breach notification letter, and more. Customize them instead of starting from scratch.
Compliance Reports
Generate four types of PDF reports: Full Compliance, Executive Summary, Gap Analysis, and Audit-Ready. Data pulls directly from your assessments.
Three steps to compliance
Set up your organization, work through the assessments, and generate the reports and evidence you need.
Set up your organization
Create your account, identify your privacy officer, select your industry. Controls and recommendations adapt to your context.
Assess and document
Work through compliance controls, log incidents, track access requests, and attach evidence to everything. Save progress and come back anytime.
Report and prove it
Generate audit-ready reports with your compliance scores, gap analysis, and attached evidence. Board meeting or regulator audit: you're covered.
Built for the people managing compliance day-to-day
Privacy officers, HR directors, operations managers. If you're the one responsible for Law 25 in your organization, this is your tool.
Stop guessing. Start proving.
Create your account, complete your first assessment, and generate a compliance report today.