Law 25 – Personal Information Protection

Law 25 is a new law adopted on September 22, 2021, that imposes new obligations on private and public organizations with respect to the protection of personal information

The provisions of Law 25 come into force in three key phases: September 22, 2022, and September 22, 2023. In addition, on September 22, 2024, you must be prepared to provide portability of personal information upon request.

What are your obligations under Law 25?

To comply with Law 25, your business is responsible for collection and processing of personal information

• Identify purposes for collection
• Limiting collection
• Collecting Personal Information by Legal and Lawful Means
• Inform the person concerned about his or her file
• Obtaining consent from data subjects in certain cases
• Document retention schedule
• Good practices for data destruction

You must also identify a Data Privacy Officer, it’s your contact person for the protection of personal information within the company !

Roles and responsibilities:

• Management of the governance framework (policies and procedures);
• Provide advice and inform staff on good privacy practices;
• Act as the main point of contact for all persons concerned;
• Oversee the privacy incident management process;
• Create and maintain various records (personal information, incidents, document lifecycle management, etc.);
• Manage notices to regulatory authorities.

Our approach is not just to write the policies, methodologies and procedures required by Law 25. The company’s compliance lies in its ability to operationalize the practices imposed by it’s governance program. It is therefore necessary that the compliance project is able to generate personal information files and a comprehensive mapping of processing activities. The use of specialized tools using AI is therefore part of our offer and approach.

Schedule a presentation on our Integrated Compliance and Privacy Program