Does your NPO comply with Law 25?

Law 25 compliance

Find out more and get in touch with one of our experts, who will answer all your questions.

What is Law 25?

Perhaps you’ve heard of Bill 25? Since September 22, 2022, Quebec has begun implementing new provisions to better protect Quebecers’ personal information with this new law. This law creates a number of new obligations for companies with Quebec visitors to their websites.

Since September 22, 2022

Companies are already required to designate and identify a data protection officer who will, among other things, keep a register of data leakage incidents and take the necessary measures to limit the risk.

From September 22, 2023

More extensive provisions came into force on September 22, 2023. Among other things, NPOs will be required to have a data privacy policy on their website, and to obtain users’ consent to the collection, disclosure or use of their personal information.

Scheduled for September 22, 2024

Finally, as of September 22, 2024, companies must also be able to transmit, at the request of the data subject, computerized personal information collected from him or her.

What this means for your nonprofit

Installation of a consent management platform

To comply with Law 25, all NPOs collecting personal information from Quebecers will have to ensure, among other things, that they have implemented a method enabling them to obtain user consent before collecting their personal data.

This also applies if you use cookies on your website or an analysis tool such as Google Analytics.

This platform will enable you to:

Automatically collect your users’ consent;
Create a consent banner customized to your situation;
Access a consent log that will enable you to meet your obligations under law 25.

Setting up a data confidentiality policy

Law 25 requires that a privacy and data governance policy be available on your nonprofit’s website to tell your users what information will be collected, how it will be used and to whom it will be shared.

To comply with the law, you’ll need to include several additional items of information to guarantee maximum transparency for your users. Our experts are available to tell you more.

Implement an array of best practices!

Law 25 requires much more than the integration of a consent management platform and the implementation of a data privacy policy. A number of processes and procedures need to be put in place to ensure proper management of personal data within your NPO.

Where to start?

Law 25 is already in force! What do you need to do?

1. If your NPO already complies with the law 25

We congratulate you on taking the many steps to get there!

2. If your NPO is not compliant

Contact us today to receive a free personalized guide to help you complete the compliance process as quickly and easily as possible.

Our pilots are there for you!