Bill 25 compliance for Quebec businesses
Certi360 helps you meet Bill 25 requirements for personal information protection — assessment, documentation and security measures adapted to your SMB.
Request a free assessmentWhat does Bill 25 require of your business?
Bill 25 imposes strict obligations on organizations that process personal information in Quebec: informed consent, transparency, data security, incident notification and documented governance. Any SMB that collects client emails, contact details or employee data is affected.
Based in Laval, Certi360 helps businesses in Greater Montreal and across Quebec turn legal requirements into concrete actions — without unnecessary bureaucracy.
Pillars of our Bill 25 support
- Compliance assessment — evaluate your current state against Bill 25 articles in force.
- Data mapping — inventory personal information collected, stored and shared.
- Policies and notices — privacy policies, collection notices and consent procedures.
- Governance — designation and support for your person responsible for the protection of personal information (PRPI).
- Security measures — technical controls aligned with ISO 27001 and ISO 27701.
- Incident response plan — notification procedures aligned with CAI deadlines.
Bill 25 and ISO 27001: a winning combination
Bill 25 defines your legal obligations; ISO 27001 structures your security program. Together, they demonstrate reasonable diligence to the Commission d'accès à l'information and your clients. Certi360 masters both frameworks and helps you avoid duplicated effort.
You can also test your website's Bill 25 posture for free with our Bill 25 Analysis tool.
Who is this service for?
Professional services firms, technology companies, NPOs, accounting firms, integrators and any organization that processes personal information of clients, employees or citizens in Quebec. If clients send you data protection questionnaires, this service is for you.
Frequently asked questions
- What is Quebec Bill 25?
- Bill 25 modernizes the protection of personal information in Quebec. It requires organizations to meet obligations around consent, transparency, data security, incident notification and appointing a person responsible for the protection of personal information.
- Is my business subject to Bill 25?
- Any organization that collects, uses or discloses personal information in the course of commercial activities in Quebec is subject to Bill 25, regardless of size. This includes SMBs, NPOs and cloud-based businesses.
- What are the penalties for non-compliance with Bill 25?
- The Commission d'accès à l'information du Québec can impose administrative penalties of up to $25 million or 4% of worldwide revenue for organizations. Beyond fines, reputation and client trust are at stake.
- How does Certi360 help with Bill 25 compliance?
- We perform a compliance assessment, map your personal data flows, draft required policies and align your controls with Bill 25 requirements and, where relevant, ISO 27001 or ISO 27701.
- Does Bill 25 require certification?
- No, Bill 25 does not require formal certification. It requires proportionate security measures and documented governance. ISO 27001 or 27701 certification can nonetheless demonstrate reasonable diligence to your clients.