Law 25 Compliance: Where to Begin When Nothing Is Formalized Yet?

Let’s be honest: many companies waited until the last minute. Others haven’t started at all.
Not out of negligence—but due to lack of time, resources, or because Law 25 seems vague, overly legal, or disconnected from day-to-day operations.

The good news? There's still time—if you act methodically.
At ONYX IMK, we help organizations put structure into their information governance, access security, and personal data practices—without jargon or overload.

What Law 25 really says (and what it means for you)

Law 25 (formerly Bill 64) governs personal data protection for all private-sector organizations operating in Quebec.

Beyond the legal text, it calls for structured practices that every well-run business should already have in place:

• Appoint a person responsible for personal data
• Maintain a record of collected data and processing methods
• Establish internal policies (access, storage, archiving, destruction)
• Get clear consent from clients, employees, users
• Be ready to respond to incidents (loss, theft, leak, attack)

The challenge? Most businesses haven't formalized any of this—and their IT systems weren’t designed with privacy in mind.

The 3 most common mistakes SMEs make

1. Thinking the law doesn't apply to them.

   Wrong. Fines aren’t based on size—they’re based on proven negligence.

2. Confusing tech security with legal compliance.

   Antivirus isn’t compliance. You also need governance, policies, and traceability.

3. Waiting for a magic solution.

   There is no "Law 25 software." Compliance is a combination of practices and adjustments tailored to your environment.

How to start a real compliance journey (even without a legal team)

At ONYX IMK, we take a practical, operational approach—no legalese, no off-the-shelf policies, no internal DPO required.

Step 1: Express audit (2–3 days)

• What personal data do you manage?
• Where is it stored? Who can access it?
• What practices are already in place (even informal)?

We map, document, and assess gaps with the law.

Step 2: Progressive compliance plan

• Prioritize based on real risks
• Write or adapt policies
• Implement concrete practices (consent, incident logs, access control)

Step 3: Team awareness

• Targeted training
• Interactive quizzes / use cases
• Embed best practices into daily operations

Is it too late? No. But you can't wait much longer.

Parts of the law are already in force: responsibility, consent, incident response.

The longer you wait:

• the higher the legal and reputational risk,
• the more reactive and costly the compliance process becomes.